build(deps): bump github.com/go-openapi/errors in /src/runtime

Bumps [github.com/go-openapi/errors](https://github.com/go-openapi/errors) from 0.22.1 to 0.22.6.
- [Release notes](https://github.com/go-openapi/errors/releases)
- [Commits](https://github.com/go-openapi/errors/compare/v0.22.1...v0.22.6)

---
updated-dependencies:
- dependency-name: github.com/go-openapi/errors
  dependency-version: 0.22.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/actionlint.yaml

@@ -28,9 +28,3 @@ self-hosted-runner:
     - s390x-large
     - tdx
     - ubuntu-24.04-arm
-
-paths:
-  .github/workflows/**/*.{yml,yaml}:
-    ignore:
-      # We use if: false to "temporarily" skip jobs with issues
-      - 'constant expression "false" in condition'

.github/workflows/actionlint.yaml

@@ -13,13 +13,18 @@ concurrency:
 jobs:
   run-actionlint:
     name: run-actionlint
+    env:
+      GH_TOKEN: ${{ github.token }}
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout the code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
           persist-credentials: false
 
+      - name: Install actionlint gh extension
+        run: gh extension install https://github.com/cschleiden/gh-actionlint
+
       - name: Run actionlint
-        uses: raven-actions/actionlint@e01d1ea33dd6a5ed517d95b4c0c357560ac6f518  # v2.1.1
+        run:  gh actionlint

.github/workflows/basic-ci-amd64.yaml

@@ -25,9 +25,10 @@ jobs:
       fail-fast: false
       matrix:
         containerd_version: ['active']
-        # vmm: ['dragonball', 'cloud-hypervisor', 'qemu-runtime-rs']
-        vmm: ['dragonball', 'qemu-runtime-rs']
-    runs-on: ubuntu-24.04
+        vmm: ['dragonball', 'cloud-hypervisor', 'qemu-runtime-rs']
+    # TODO: enable me when https://github.com/containerd/containerd/issues/11640 is fixed
+    if: false
+    runs-on: ubuntu-22.04
     env:
       CONTAINERD_VERSION: ${{ matrix.containerd_version }}
       GOPATH: ${{ github.workspace }}
@@ -46,23 +47,6 @@ jobs:
         env:
           TARGET_BRANCH: ${{ inputs.target-branch }}
 
-      - name: Install yq
-        run: |
-          ./ci/install_yq.sh
-        env:
-          INSTALL_IN_GOPATH: false
-
-      - name: Read properties from versions.yaml
-        run: |
-          go_version="$(yq '.languages.golang.version' versions.yaml)"
-          [ -n "$go_version" ]
-          echo "GO_VERSION=${go_version}" >> "$GITHUB_ENV"
-
-      - name: Setup Golang version ${{ env.GO_VERSION }}
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
-        with:
-          go-version: ${{ env.GO_VERSION }}
-
       - name: Install dependencies
         run: bash tests/integration/cri-containerd/gha-run.sh install-dependencies
         env:

.github/workflows/basic-ci-s390x.yaml

@@ -47,25 +47,8 @@ jobs:
         env:
           TARGET_BRANCH: ${{ inputs.target-branch }}
 
-      - name: Install yq
-        run: |
-          ./ci/install_yq.sh
-        env:
-          INSTALL_IN_GOPATH: false
-
-      - name: Read properties from versions.yaml
-        run: |
-          go_version="$(yq '.languages.golang.version' versions.yaml)"
-          [ -n "$go_version" ]
-          echo "GO_VERSION=${go_version}" >> "$GITHUB_ENV"
-
-      - name: Setup Golang version ${{ env.GO_VERSION }}
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
-        with:
-          go-version: ${{ env.GO_VERSION }}
-
       - name: Install dependencies
-        run: bash tests/integration/cri-containerd/gha-run.sh install-dependencies
+        run: bash tests/integration/cri-containerd/gha-run.sh
         env:
           GH_TOKEN: ${{ github.token }}
 

.github/workflows/build-checks-preview-riscv64.yaml

@@ -82,17 +82,11 @@ jobs:
           ./ci/install_yq.sh
         env:
           INSTALL_IN_GOPATH: false
-      - name: Read properties from versions.yaml
+      - name: Install golang
         if: contains(matrix.component.needs, 'golang')
         run: |
-          go_version="$(yq '.languages.golang.version' versions.yaml)"
-          [ -n "$go_version" ]
-          echo "GO_VERSION=${go_version}" >> "$GITHUB_ENV"
-      - name: Setup Golang version ${{ env.GO_VERSION }}
-        if: contains(matrix.component.needs, 'golang')
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
-        with:
-          go-version: ${{ env.GO_VERSION }}
+          ./tests/install_go.sh -f -p
+          echo "/usr/local/go/bin" >> "$GITHUB_PATH"
       - name: Setup rust
         if: contains(matrix.component.needs, 'rust')
         run: |

.github/workflows/build-kata-static-tarball-amd64.yaml

@@ -143,7 +143,7 @@ jobs:
           if-no-files-found: error
 
       - name: store-extratarballs-artifact ${{ matrix.asset }}
-        if: ${{ startsWith(matrix.asset, 'kernel-nvidia-gpu') }}
+        if: ${{ matrix.asset == 'kernel' || startsWith(matrix.asset, 'kernel-nvidia-gpu') }}
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: kata-artifacts-amd64-${{ matrix.asset }}-modules${{ inputs.tarball-suffix }}
@@ -235,6 +235,7 @@ jobs:
         asset:
           - busybox
           - coco-guest-components
+          - kernel-modules
           - kernel-nvidia-gpu-modules
           - pause-image
     steps:

.github/workflows/build-kata-static-tarball-s390x.yaml

@@ -120,6 +120,15 @@ jobs:
           retention-days: 15
           if-no-files-found: error
 
+      - name: store-extratarballs-artifact ${{ matrix.asset }}
+        if: ${{ matrix.asset == 'kernel' }}
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: kata-artifacts-s390x-${{ matrix.asset }}-modules${{ inputs.tarball-suffix }}
+          path: kata-build/kata-static-${{ matrix.asset }}-modules.tar.zst
+          retention-days: 15
+          if-no-files-found: error
+
   build-asset-rootfs:
     name: build-asset-rootfs
     runs-on: s390x

.github/workflows/ci-devel.yaml

@@ -17,7 +17,6 @@ jobs:
       pr-number: "dev"
       tag: ${{ github.sha }}-dev
       target-branch: ${{ github.ref_name }}
-      extensive-matrix-autogenerated-policy: "yes"
 
     secrets:
       AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}

.github/workflows/ci-nightly.yaml

@@ -22,7 +22,6 @@ jobs:
       pr-number: "nightly"
       tag: ${{ github.sha }}-nightly
       target-branch: ${{ github.ref_name }}
-      extensive-matrix-autogenerated-policy: "yes"
     secrets:
       AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
       AZ_APPID: ${{ secrets.AZ_APPID }}

.github/workflows/ci.yaml

@@ -19,10 +19,6 @@ on:
         required: false
         type: string
         default: no
-      extensive-matrix-autogenerated-policy:
-        required: false
-        type: string
-        default: no
     secrets:
       AUTHENTICATED_IMAGE_PASSWORD:
         required: true
@@ -362,7 +358,6 @@ jobs:
       commit-hash: ${{ inputs.commit-hash }}
       pr-number: ${{ inputs.pr-number }}
       target-branch: ${{ inputs.target-branch }}
-      extensive-matrix-autogenerated-policy: ${{ inputs.extensive-matrix-autogenerated-policy }}
     secrets:
       AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
       AZ_APPID: ${{ secrets.AZ_APPID }}

.github/workflows/darwin-tests.yaml

@@ -31,22 +31,10 @@ jobs:
       with:
         persist-credentials: false
 
-    - name: Install yq
+    - name: Install golang
       run: |
-        ./ci/install_yq.sh
-      env:
-        INSTALL_IN_GOPATH: false
-
-    - name: Read properties from versions.yaml
-      run: |
-        go_version="$(yq '.languages.golang.version' versions.yaml)"
-        [ -n "$go_version" ]
-        echo "GO_VERSION=${go_version}" >> "$GITHUB_ENV"
-
-    - name: Setup Golang version ${{ env.GO_VERSION }}
-      uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
-      with:
-        go-version: ${{ env.GO_VERSION }}
+        ./tests/install_go.sh -f -p
+        echo "/usr/local/go/bin" >> "${GITHUB_PATH}"
 
     - name: Install Rust
       run: ./tests/install_rust.sh

.github/workflows/docs-url-alive-check.yaml

@@ -24,22 +24,10 @@ jobs:
         fetch-depth: 0
         persist-credentials: false
 
-    - name: Install yq
+    - name: Install golang
       run: |
-        ./ci/install_yq.sh
-      env:
-        INSTALL_IN_GOPATH: false
-
-    - name: Read properties from versions.yaml
-      run: |
-        go_version="$(yq '.languages.golang.version' versions.yaml)"
-        [ -n "$go_version" ]
-        echo "GO_VERSION=${go_version}" >> "$GITHUB_ENV"
-
-    - name: Setup Golang version ${{ env.GO_VERSION }}
-      uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
-      with:
-        go-version: ${{ env.GO_VERSION }}
+        ./tests/install_go.sh -f -p
+        echo "/usr/local/go/bin" >> "${GITHUB_PATH}"
 
     - name: Docs URL Alive Check
       run: |

.github/workflows/govulncheck.yaml

@@ -27,22 +27,10 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Install yq
+      - name: Install golang
         run: |
-          ./ci/install_yq.sh
-        env:
-          INSTALL_IN_GOPATH: false
-
-      - name: Read properties from versions.yaml
-        run: |
-          go_version="$(yq '.languages.golang.version' versions.yaml)"
-          [ -n "$go_version" ]
-          echo "GO_VERSION=${go_version}" >> "$GITHUB_ENV"
-
-      - name: Setup Golang version ${{ env.GO_VERSION }}
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
-        with:
-          go-version: ${{ env.GO_VERSION }}
+          ./tests/install_go.sh -f -p
+          echo "/usr/local/go/bin" >> "${GITHUB_PATH}"
 
       - name: Install govulncheck
         run: |

.github/workflows/run-cri-containerd-tests.yaml

@@ -53,25 +53,6 @@ jobs:
         env:
           TARGET_BRANCH: ${{ inputs.target-branch }}
 
-      - name: Install yq
-        run: |
-          ./ci/install_yq.sh
-        env:
-          INSTALL_IN_GOPATH: false
-
-      - name: Read properties from versions.yaml
-        run: |
-          go_version="$(yq '.languages.golang.version' versions.yaml)"
-          [ -n "$go_version" ]
-          echo "GO_VERSION=${go_version}" >> "$GITHUB_ENV"
-
-      - name: Setup Golang version ${{ env.GO_VERSION }}
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
-        with:
-          go-version: ${{ env.GO_VERSION }}
-          # Setup-go doesn't work properly with ppc64le: https://github.com/actions/setup-go/issues/648
-          architecture: ${{ inputs.arch == 'ppc64le' && 'ppc64le' || '' }}
-
       - name: Install dependencies
         timeout-minutes: 15
         run: bash tests/integration/cri-containerd/gha-run.sh install-dependencies

.github/workflows/run-k8s-tests-on-ppc64le.yaml

@@ -57,24 +57,10 @@ jobs:
         env:
           TARGET_BRANCH: ${{ inputs.target-branch }}
 
-      - name: Install yq
+      - name: Install golang
         run: |
-          ./ci/install_yq.sh
-        env:
-          INSTALL_IN_GOPATH: false
-
-      - name: Read properties from versions.yaml
-        run: |
-          go_version="$(yq '.languages.golang.version' versions.yaml)"
-          [ -n "$go_version" ]
-          echo "GO_VERSION=${go_version}" >> "$GITHUB_ENV"
-
-      - name: Setup Golang version ${{ env.GO_VERSION }}
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
-        with:
-          go-version: ${{ env.GO_VERSION }}
-          # Setup-go doesn't work properly with ppc64le: https://github.com/actions/setup-go/issues/648
-          architecture: 'ppc64le'
+          ./tests/install_go.sh -f -p
+          echo "/usr/local/go/bin" >> "$GITHUB_PATH"
 
       - name: Prepare the runner for k8s test suite
         run: bash "${HOME}/scripts/k8s_cluster_prepare.sh"

.github/workflows/run-kata-coco-tests.yaml

@@ -24,10 +24,6 @@ on:
         required: false
         type: string
         default: ""
-      extensive-matrix-autogenerated-policy:
-        required: false
-        type: string
-        default: no
     secrets:
       AUTHENTICATED_IMAGE_PASSWORD:
         required: true
@@ -262,136 +258,6 @@ jobs:
         timeout-minutes: 5
         run: bash tests/integration/kubernetes/gha-run.sh delete-csi-driver
 
-  # Extensive matrix: autogenerated policy tests (nydus + experimental-force-guest-pull) on k0s, k3s, rke2, microk8s with qemu-coco-dev / qemu-coco-dev-runtime-rs
-  run-k8s-tests-coco-nontee-extensive-matrix:
-    if: ${{ inputs.extensive-matrix-autogenerated-policy == 'yes' }}
-    name: run-k8s-tests-coco-nontee-extensive-matrix
-    strategy:
-      fail-fast: false
-      matrix:
-        environment: [
-          { k8s: k0s, vmm: qemu-coco-dev, snapshotter: nydus, pull_type: guest-pull },
-          { k8s: k0s, vmm: qemu-coco-dev, snapshotter: "", pull_type: experimental-force-guest-pull },
-          { k8s: k0s, vmm: qemu-coco-dev-runtime-rs, snapshotter: nydus, pull_type: guest-pull },
-          { k8s: k3s, vmm: qemu-coco-dev, snapshotter: nydus, pull_type: guest-pull },
-          { k8s: k3s, vmm: qemu-coco-dev, snapshotter: "", pull_type: experimental-force-guest-pull },
-          { k8s: k3s, vmm: qemu-coco-dev-runtime-rs, snapshotter: nydus, pull_type: guest-pull },
-          { k8s: rke2, vmm: qemu-coco-dev, snapshotter: nydus, pull_type: guest-pull },
-          { k8s: rke2, vmm: qemu-coco-dev, snapshotter: "", pull_type: experimental-force-guest-pull },
-          { k8s: rke2, vmm: qemu-coco-dev-runtime-rs, snapshotter: nydus, pull_type: guest-pull },
-          { k8s: microk8s, vmm: qemu-coco-dev, snapshotter: nydus, pull_type: guest-pull },
-          { k8s: microk8s, vmm: qemu-coco-dev, snapshotter: "", pull_type: experimental-force-guest-pull },
-          { k8s: microk8s, vmm: qemu-coco-dev-runtime-rs, snapshotter: nydus, pull_type: guest-pull },
-        ]
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: read
-    environment: ci
-    env:
-      DOCKER_REGISTRY: ${{ inputs.registry }}
-      DOCKER_REPO: ${{ inputs.repo }}
-      DOCKER_TAG: ${{ inputs.tag }}
-      GH_PR_NUMBER: ${{ inputs.pr-number }}
-      KATA_HYPERVISOR: ${{ matrix.environment.vmm }}
-      KBS: "true"
-      KBS_INGRESS: "nodeport"
-      KUBERNETES: ${{ matrix.environment.k8s }}
-      SNAPSHOTTER: ${{ matrix.environment.snapshotter }}
-      PULL_TYPE: ${{ matrix.environment.pull_type }}
-      EXPERIMENTAL_FORCE_GUEST_PULL: ${{ matrix.environment.pull_type == 'experimental-force-guest-pull' && matrix.environment.vmm || '' }}
-      AUTHENTICATED_IMAGE_USER: ${{ vars.AUTHENTICATED_IMAGE_USER }}
-      AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
-      AUTO_GENERATE_POLICY: "yes"
-      K8S_TEST_HOST_TYPE: "all"
-      GH_TOKEN: ${{ github.token }}
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ inputs.commit-hash }}
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Rebase atop of the latest target branch
-        run: |
-          ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
-        env:
-          TARGET_BRANCH: ${{ inputs.target-branch }}
-
-      - name: get-kata-tools-tarball
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          name: kata-tools-static-tarball-amd64${{ inputs.tarball-suffix }}
-          path: kata-tools-artifacts
-
-      - name: Install kata-tools
-        run: bash tests/integration/kubernetes/gha-run.sh install-kata-tools kata-tools-artifacts
-
-      - name: Remove unnecessary directories to free up space
-        run: |
-          sudo rm -rf /usr/local/.ghcup
-          sudo rm -rf /opt/hostedtoolcache/CodeQL
-          sudo rm -rf /usr/local/lib/android
-          sudo rm -rf /usr/share/dotnet
-          sudo rm -rf /opt/ghc
-          sudo rm -rf /usr/local/share/boost
-          sudo rm -rf /usr/lib/jvm
-          sudo rm -rf /usr/share/swift
-          sudo rm -rf /usr/local/share/powershell
-          sudo rm -rf /usr/local/julia*
-          sudo rm -rf /opt/az
-          sudo rm -rf /usr/local/share/chromium
-          sudo rm -rf /opt/microsoft
-          sudo rm -rf /opt/google
-          sudo rm -rf /usr/lib/firefox
-
-      - name: Deploy ${{ matrix.environment.k8s }}
-        timeout-minutes: 15
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-k8s
-
-      - name: Install `bats`
-        run: bash tests/integration/kubernetes/gha-run.sh install-bats
-
-      - name: Deploy Kata
-        timeout-minutes: 20
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-kata
-        env:
-          USE_EXPERIMENTAL_SETUP_SNAPSHOTTER: ${{ matrix.environment.snapshotter == 'nydus' }}
-
-      - name: Deploy CoCo KBS
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-coco-kbs
-
-      - name: Install `kbs-client`
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh install-kbs-client
-
-      - name: Deploy CSI driver
-        timeout-minutes: 5
-        run: bash tests/integration/kubernetes/gha-run.sh deploy-csi-driver
-
-      - name: Run tests
-        timeout-minutes: 80
-        run: bash tests/integration/kubernetes/gha-run.sh run-tests
-
-      - name: Report tests
-        if: always()
-        run: bash tests/integration/kubernetes/gha-run.sh report-tests
-
-      - name: Delete kata-deploy
-        if: always()
-        timeout-minutes: 15
-        run: bash tests/integration/kubernetes/gha-run.sh cleanup
-
-      - name: Delete CoCo KBS
-        if: always()
-        timeout-minutes: 10
-        run: bash tests/integration/kubernetes/gha-run.sh delete-coco-kbs
-
-      - name: Delete CSI driver
-        if: always()
-        timeout-minutes: 5
-        run: bash tests/integration/kubernetes/gha-run.sh delete-csi-driver
-
   # Generate jobs for testing CoCo on non-TEE environments with erofs-snapshotter
   run-k8s-tests-coco-nontee-with-erofs-snapshotter:
     name: run-k8s-tests-coco-nontee-with-erofs-snapshotter

.github/workflows/static-checks.yaml

@@ -126,16 +126,11 @@ jobs:
           ./ci/install_yq.sh
         env:
           INSTALL_IN_GOPATH: false
-      - name: Read properties from versions.yaml
+      - name: Install golang
         run: |
           cd "${GOPATH}/src/github.com/${GITHUB_REPOSITORY}"
-          go_version="$(yq '.languages.golang.version' versions.yaml)"
-          [ -n "$go_version" ]
-          echo "GO_VERSION=${go_version}" >> "$GITHUB_ENV"
-      - name: Setup Golang version ${{ env.GO_VERSION }}
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
-        with:
-          go-version: ${{ env.GO_VERSION }}
+          ./tests/install_go.sh -f -p
+          echo "/usr/local/go/bin" >> "$GITHUB_PATH"
       - name: Install system dependencies
         run: |
           sudo apt-get update && sudo apt-get -y install moreutils hunspell hunspell-en-gb hunspell-en-us pandoc

Cargo.lock

@@ -3922,7 +3922,6 @@ dependencies = [
  "agent",
  "anyhow",
  "common",
- "containerd-shim-protos",
  "hyper",
  "hypervisor",
  "kata-sys-util",

docs/Limitations.md

@@ -187,10 +187,9 @@ different compared to `runc` containers:
 into the guest and exposes it directly to the container.
 
 **Mounting guest devices**: When the source path of a hostPath volume is
-under `/dev` (or `/dev` itself), and the path corresponds to a
-non-regular file (i.e., a device, directory, or any other special file)
-or is not accessible by the Kata shim, the Kata agent bind mounts the
-source path directly from the *guest* filesystem into the container.
+under `/dev`, and the path either corresponds to a host device or is not
+accessible by the Kata shim, the Kata agent bind mounts the source path
+directly from the *guest* filesystem into the container.
 
 [runtime-config]: /src/runtime/README.md#configuration
 [k8s-hostpath]: https://kubernetes.io/docs/concepts/storage/volumes/#hostpath
@@ -227,35 +226,6 @@ Importantly, the default behavior to pass the host devices to a
 privileged container is not supported in Kata Containers and needs to be
 disabled, see [Privileged Kata Containers](how-to/privileged.md).
 
-## Guest pulled container images
-
-When using features like **nydus guest-pull**, set user/group IDs explicitly in the pod spec.
-If the ID values are omitted:
-
-- Your workload might be executed with unexpected user/group ID values, because image layers
-  may be unavailable to containerd, so image config (including user/group) is not applied.
-- If using policy or genpolicy, the generated policy may detect these unexpected values and
-  reject the creation of workload containers.
-
-Set `securityContext` explicitly. Use **pod-level** `spec.securityContext` (for Pods) or
-`spec.template.spec.securityContext` (for controllers like Deployments) and/or **container-level**
-`spec.containers[].securityContext`. Include at least:
-- `runAsUser` — primary user ID
-- `runAsGroup` — primary group ID
-- `fsGroup` — volume group ownership (often reflected as a supplemental group)
-- `supplementalGroups` — list of additional group IDs (if needed)
-
-Example:
-
- ```yaml
- # Explicit user/group/supplementary groups to support nydus guest-pull
- securityContext:
-   runAsUser: 0
-   runAsGroup: 0
-   fsGroup: 0
-   supplementalGroups: [1, 2, 3, 4, 6, 10, 11, 20, 26, 27]
- ```
-
 # Appendices
 
 ## The constraints challenge

docs/how-to/how-to-use-the-kata-agent-policy.md

@@ -99,9 +99,6 @@ The [`genpolicy`](../../src/tools/genpolicy/) application can be used to generat
 
 **Warning** Users should review carefully the automatically-generated Policy, and modify the Policy file if needed to match better their use case, before using this Policy.
 
-**Important — User / Group / Supplemental groups for Policy and genpolicy**
-When using features like **nydus guest-pull**, set user/group IDs explicitly in the pod spec, as described in [Limitations](../Limitations.md#guest-pulled-container-images).
-
 See the [`genpolicy` documentation](../../src/tools/genpolicy/README.md) and the [Policy contents examples](#policy-contents) for additional information.
 
 ## Policy contents

src/libs/kata-types/src/config/hypervisor/ch.rs

@@ -13,7 +13,6 @@ use super::{default, register_hypervisor_plugin};
 use crate::config::default::MAX_CH_VCPUS;
 use crate::config::default::MIN_CH_MEMORY_SIZE_MB;
 
-use crate::config::hypervisor::VIRTIO_BLK_MMIO;
 use crate::config::{ConfigPlugin, TomlConfig};
 use crate::{resolve_path, validate_path};
 
@@ -105,16 +104,6 @@ impl ConfigPlugin for CloudHypervisorConfig {
                 ));
             }
 
-            // CoCo guest hardening: virtio-mmio is not hardened for confidential computing.
-            if ch.security_info.confidential_guest
-                && ch.boot_info.vm_rootfs_driver == VIRTIO_BLK_MMIO
-            {
-                return Err(std::io::Error::other(
-                    "Confidential guests must not use virtio-blk-mmio (use virtio-blk-pci); \
-                     virtio-mmio is not hardened for CoCo",
-                ));
-            }
-
             if ch.boot_info.kernel.is_empty() {
                 return Err(std::io::Error::other("Guest kernel image for CH is empty"));
             }

src/libs/kata-types/src/config/hypervisor/qemu.rs

@@ -124,17 +124,6 @@ impl ConfigPlugin for QemuConfig {
                 ));
             }
 
-            // CoCo guest hardening: virtio-mmio transport is not hardened for confidential
-            // computing; only virtio-pci is. Ensure we never use virtio-blk-mmio for rootfs.
-            if qemu.security_info.confidential_guest
-                && qemu.boot_info.vm_rootfs_driver == VIRTIO_BLK_MMIO
-            {
-                return Err(std::io::Error::other(
-                    "Confidential guests must not use virtio-blk-mmio (use virtio-blk-pci); \
-                     virtio-mmio is not hardened for CoCo",
-                ));
-            }
-
             if qemu.boot_info.kernel.is_empty() {
                 return Err(std::io::Error::other(
                     "Guest kernel image for qemu is empty",

src/runtime-rs/crates/runtimes/Cargo.toml

@@ -11,7 +11,6 @@ lazy_static = { workspace = true }
 netns-rs = { workspace = true }
 slog = { workspace = true }
 slog-scope = { workspace = true }
-containerd-shim-protos = { workspace = true }
 tokio = { workspace = true, features = ["rt-multi-thread"] }
 tracing = { workspace = true }
 tracing-opentelemetry = { workspace = true }

src/runtime-rs/crates/runtimes/common/src/message.rs

@@ -6,7 +6,7 @@
 use std::sync::Arc;
 
 use anyhow::{Context, Result};
-use containerd_shim_protos::events::task::{TaskCreate, TaskDelete, TaskExit, TaskOOM, TaskStart};
+use containerd_shim_protos::events::task::{TaskExit, TaskOOM};
 use containerd_shim_protos::protobuf::Message as ProtobufMessage;
 use tokio::sync::mpsc::{channel, Receiver, Sender};
 
@@ -49,15 +49,9 @@ impl Message {
 
 const TASK_OOM_EVENT_TOPIC: &str = "/tasks/oom";
 const TASK_EXIT_EVENT_TOPIC: &str = "/tasks/exit";
-const TASK_START_EVENT_TOPIC: &str = "/tasks/start";
-const TASK_CREATE_EVENT_TOPIC: &str = "/tasks/create";
-const TASK_DELETE_EVENT_TOPIC: &str = "/tasks/delete";
 
 const TASK_OOM_EVENT_URL: &str = "containerd.events.TaskOOM";
 const TASK_EXIT_EVENT_URL: &str = "containerd.events.TaskExit";
-const TASK_START_EVENT_URL: &str = "containerd.events.TaskStart";
-const TASK_CREATE_EVENT_URL: &str = "containerd.events.TaskCreate";
-const TASK_DELETE_EVENT_URL: &str = "containerd.events.TaskDelete";
 
 pub trait Event: std::fmt::Debug + Send {
     fn r#type(&self) -> String;
@@ -92,45 +86,3 @@ impl Event for TaskExit {
         self.write_to_bytes().context("get exit value")
     }
 }
-
-impl Event for TaskStart {
-    fn r#type(&self) -> String {
-        TASK_START_EVENT_TOPIC.to_string()
-    }
-
-    fn type_url(&self) -> String {
-        TASK_START_EVENT_URL.to_string()
-    }
-
-    fn value(&self) -> Result<Vec<u8>> {
-        self.write_to_bytes().context("get start value")
-    }
-}
-
-impl Event for TaskCreate {
-    fn r#type(&self) -> String {
-        TASK_CREATE_EVENT_TOPIC.to_string()
-    }
-
-    fn type_url(&self) -> String {
-        TASK_CREATE_EVENT_URL.to_string()
-    }
-
-    fn value(&self) -> Result<Vec<u8>> {
-        self.write_to_bytes().context("get create value")
-    }
-}
-
-impl Event for TaskDelete {
-    fn r#type(&self) -> String {
-        TASK_DELETE_EVENT_TOPIC.to_string()
-    }
-
-    fn type_url(&self) -> String {
-        TASK_DELETE_EVENT_URL.to_string()
-    }
-
-    fn value(&self) -> Result<Vec<u8>> {
-        self.write_to_bytes().context("get delete value")
-    }
-}

src/runtime-rs/crates/runtimes/src/manager.rs

@@ -6,16 +6,14 @@
 
 use anyhow::{anyhow, Context, Result};
 use common::{
-    message::{Action, Message},
+    message::Message,
     types::{
-        ContainerProcess, PlatformInfo, ProcessType, SandboxConfig, SandboxRequest,
-        SandboxResponse, SandboxStatusInfo, StartSandboxInfo, TaskRequest, TaskResponse,
-        DEFAULT_SHM_SIZE,
+        ContainerProcess, PlatformInfo, SandboxConfig, SandboxRequest, SandboxResponse,
+        SandboxStatusInfo, StartSandboxInfo, TaskRequest, TaskResponse, DEFAULT_SHM_SIZE,
     },
     RuntimeHandler, RuntimeInstance, Sandbox, SandboxNetworkEnv,
 };
 
-use containerd_shim_protos::events::task::{TaskCreate, TaskDelete, TaskStart};
 use hypervisor::{
     utils::{create_dir_all_with_inherit_owner, create_vmm_user, remove_vmm_user},
     Param,
@@ -35,13 +33,13 @@ use netns_rs::{Env, NetNs};
 use nix::{sys::statfs, unistd::User};
 use oci_spec::runtime as oci;
 use persist::sandbox_persist::Persist;
-use protobuf::Message as ProtobufMessage;
 use resource::{
     cpu_mem::initial_size::InitialSizeManager,
     network::{dan_config_path, generate_netns_name},
 };
 use runtime_spec as spec;
 use shim_interface::shim_mgmt::ERR_NO_SHIM_SERVER;
+use protobuf::Message as ProtobufMessage;
 use std::{
     collections::HashMap,
     env,
@@ -482,7 +480,6 @@ impl RuntimeHandlerManager {
                 .await
                 .context("start sandbox in task handler")?;
 
-            let bundle = container_config.bundle.clone();
             let container_id = container_config.container_id.clone();
             let shim_pid = instance
                 .container_manager
@@ -504,19 +501,6 @@ impl RuntimeHandlerManager {
                 }
             });
 
-            let msg_sender = self.inner.read().await.msg_sender.clone();
-            let event = TaskCreate {
-                container_id,
-                bundle,
-                pid,
-                ..Default::default()
-            };
-            let msg = Message::new(Action::Event(Arc::new(event)));
-            msg_sender
-                .send(msg)
-                .await
-                .context("send task create event")?;
-
             Ok(TaskResponse::CreateContainer(shim_pid))
         } else {
             self.handler_task_request(req)
@@ -586,7 +570,6 @@ impl RuntimeHandlerManager {
             .context("get runtime instance")?;
         let sandbox = instance.sandbox.clone();
         let cm = instance.container_manager.clone();
-        let msg_sender = self.inner.read().await.msg_sender.clone();
 
         match req {
             TaskRequest::CreateContainer(req) => Err(anyhow!("Unreachable TaskRequest {:?}", req)),
@@ -596,20 +579,6 @@ impl RuntimeHandlerManager {
             }
             TaskRequest::DeleteProcess(process_id) => {
                 let resp = cm.delete_process(&process_id).await.context("do delete")?;
-                if process_id.process_type == ProcessType::Container {
-                    let event = TaskDelete {
-                        id: process_id.container_id().to_string(),
-                        pid: resp.pid.pid,
-                        exit_status: resp.exit_status as u32,
-                        ..Default::default()
-                    };
-                    let msg = Message::new(Action::Event(Arc::new(event)));
-                    msg_sender
-                        .send(msg)
-                        .await
-                        .context("send task delete event")?;
-                }
-
                 Ok(TaskResponse::DeleteProcess(resp))
             }
             TaskRequest::ExecProcess(req) => {
@@ -645,28 +614,12 @@ impl RuntimeHandlerManager {
                     .context("start process")?;
 
                 let pid = shim_pid.pid;
-                let process_type = process_id.process_type;
-                let container_id = process_id.container_id().to_string();
                 tokio::spawn(async move {
                     let result = sandbox.wait_process(cm, process_id, pid).await;
                     if let Err(e) = result {
                         error!(sl!(), "sandbox wait process error: {:?}", e);
                     }
                 });
-
-                if process_type == ProcessType::Container {
-                    let event = TaskStart {
-                        container_id,
-                        pid,
-                        ..Default::default()
-                    };
-                    let msg = Message::new(Action::Event(Arc::new(event)));
-                    msg_sender
-                        .send(msg)
-                        .await
-                        .context("send task start event")?;
-                }
-
                 Ok(TaskResponse::StartProcess(shim_pid))
             }
 

src/runtime/Makefile

@@ -147,14 +147,10 @@ DEFROOTFSTYPE := $(ROOTFSTYPE_EXT4)
 FIRMWAREPATH :=
 FIRMWAREVOLUMEPATH :=
 
-FIRMWAREPATH_NV = $(FIRMWAREPATH)
-
 FIRMWARETDVFPATH := $(PREFIXDEPS)/share/ovmf/OVMF.inteltdx.fd
-FIRMWARETDVFPATH_NV := $(FIRMWARETDVFPATH)
 FIRMWARETDVFVOLUMEPATH :=
 
 FIRMWARESNPPATH := $(PREFIXDEPS)/share/ovmf/AMDSEV.fd
-FIRMWARESNPPATH_NV := $(FIRMWARESNPPATH)
 
 KERNELVERITYPARAMS ?= ""
 KERNELVERITYPARAMS_NV ?= ""
@@ -305,11 +301,9 @@ DEFDANCONF := /run/kata-containers/dans
 
 DEFFORCEGUESTPULL := false
 
-DEFKUBELETROOTDIR := /var/lib/kubelet
-
 # Device cold plug
 DEFPODRESOURCEAPISOCK := ""
-DEFPODRESOURCEAPISOCK_NV := "$(DEFKUBELETROOTDIR)/pod-resources/kubelet.sock"
+DEFPODRESOURCEAPISOCK_NV := "/var/lib/kubelet/pod-resources/kubelet.sock"
 
 SED = sed
 
@@ -474,8 +468,8 @@ ifneq (,$(QEMUCMD))
     KERNELSEPATH = $(KERNELDIR)/$(KERNELSENAME)
 
     # NVIDIA GPU specific options (all should be suffixed by _NV)
-    KERNELTYPE_NV = compressed
-    KERNELNAME_NV = $(call MAKE_KERNEL_NAME_NV,$(KERNELTYPE_NV))
+    # Normal: uncompressed (KERNELTYPE). Confidential: compressed (KERNELCONFIDENTIALTYPE).
+    KERNELNAME_NV = $(call MAKE_KERNEL_NAME_NV,$(KERNELTYPE))
     KERNELPATH_NV = $(KERNELDIR)/$(KERNELNAME_NV)
     KERNELNAME_CONFIDENTIAL_NV = $(call MAKE_KERNEL_NAME_NV,$(KERNELCONFIDENTIALTYPE))
     KERNELPATH_CONFIDENTIAL_NV = $(KERNELDIR)/$(KERNELNAME_CONFIDENTIAL_NV)
@@ -491,9 +485,6 @@ ifneq (,$(QEMUCMD))
     # using an image and /dev is already mounted.
     KERNELPARAMS_NV = "cgroup_no_v1=all"
     KERNELPARAMS_NV += "devtmpfs.mount=0"
-    KERNELPARAMS_NV += "pci=realloc"
-    KERNELPARAMS_NV += "pci=nocrs"
-    KERNELPARAMS_NV += "pci=assign-busses"
 
     # Setting this to false can lead to cgroup leakages in the host
     # Best practice for production is to set this to true
@@ -690,13 +681,10 @@ USER_VARS += KERNELPATH_FC
 USER_VARS += KERNELPATH_STRATOVIRT
 USER_VARS += KERNELVIRTIOFSPATH
 USER_VARS += FIRMWAREPATH
-USER_VARS += FIRMWAREPATH_NV
 USER_VARS += FIRMWARETDVFPATH
 USER_VARS += FIRMWAREVOLUMEPATH
 USER_VARS += FIRMWARETDVFVOLUMEPATH
 USER_VARS += FIRMWARESNPPATH
-USER_VARS += FIRMWARETDVFPATH_NV
-USER_VARS += FIRMWARESNPPATH_NV
 USER_VARS += MACHINEACCELERATORS
 USER_VARS += CPUFEATURES
 USER_VARS += TDXCPUFEATURES
@@ -797,7 +785,6 @@ USER_VARS += DEFSTATICRESOURCEMGMT_NV
 USER_VARS += DEFBINDMOUNTS
 USER_VARS += DEFCREATECONTAINERTIMEOUT
 USER_VARS += DEFDANCONF
-USER_VARS += DEFKUBELETROOTDIR
 USER_VARS += DEFFORCEGUESTPULL
 USER_VARS += DEFVFIOMODE
 USER_VARS += DEFVFIOMODE_SE

src/runtime/config/configuration-clh.toml.in

@@ -491,11 +491,6 @@ create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
 # (default: /run/kata-containers/dans)
 dan_conf = "@DEFDANCONF@"
 
-# kubelet_root_dir is the kubelet root directory used to match ConfigMap/Secret
-# volume paths for propagation. Override for distros that use a different path
-# (e.g. k0s: /var/lib/k0s/kubelet).
-kubelet_root_dir = "@DEFKUBELETROOTDIR@"
-
 # pod_resource_api_sock specifies the unix socket for the Kubelet's
 # PodResource API endpoint. If empty, kubernetes based cold plug
 # will not be attempted. In order for this feature to work, the

src/runtime/config/configuration-fc.toml.in

@@ -382,11 +382,6 @@ create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
 # (default: /run/kata-containers/dans)
 dan_conf = "@DEFDANCONF@"
 
-# kubelet_root_dir is the kubelet root directory used to match ConfigMap/Secret
-# volume paths for propagation. Override for distros that use a different path
-# (e.g. k0s: /var/lib/k0s/kubelet).
-kubelet_root_dir = "@DEFKUBELETROOTDIR@"
-
 # pod_resource_api_sock specifies the unix socket for the Kubelet's
 # PodResource API endpoint. If empty, kubernetes based cold plug
 # will not be attempted. In order for this feature to work, the

src/runtime/config/configuration-qemu-cca.toml.in

@@ -670,12 +670,6 @@ dan_conf = "@DEFDANCONF@"
 # the container image should be pulled in the guest, without using an external snapshotter.
 # This is an experimental feature and might be removed in the future.
 experimental_force_guest_pull = @DEFFORCEGUESTPULL@
-
-# kubelet_root_dir is the kubelet root directory used to match ConfigMap/Secret
-# volume paths for propagation. Override for distros that use a different path
-# (e.g. k0s: /var/lib/k0s/kubelet).
-kubelet_root_dir = "@DEFKUBELETROOTDIR@"
-
 # pod_resource_api_sock specifies the unix socket for the Kubelet's
 # PodResource API endpoint. If empty, kubernetes based cold plug
 # will not be attempted. In order for this feature to work, the

src/runtime/config/configuration-qemu-coco-dev.toml.in

@@ -734,11 +734,6 @@ dan_conf = "@DEFDANCONF@"
 # This is an experimental feature and might be removed in the future.
 experimental_force_guest_pull = @DEFFORCEGUESTPULL@
 
-# kubelet_root_dir is the kubelet root directory used to match ConfigMap/Secret
-# volume paths for propagation. Override for distros that use a different path
-# (e.g. k0s: /var/lib/k0s/kubelet).
-kubelet_root_dir = "@DEFKUBELETROOTDIR@"
-
 # pod_resource_api_sock specifies the unix socket for the Kubelet's
 # PodResource API endpoint. If empty, kubernetes based cold plug
 # will not be attempted. In order for this feature to work, the

src/runtime/config/configuration-qemu-nvidia-gpu-snp.toml.in

@@ -99,7 +99,7 @@ kernel_verity_params = "@KERNELVERITYPARAMS_CONFIDENTIAL_NV@"
 
 # Path to the firmware.
 # If you want that qemu uses the default firmware leave this option empty
-firmware = "@FIRMWARESNPPATH_NV@"
+firmware = "@FIRMWARESNPPATH@"
 
 # Path to the firmware volume.
 # firmware TDVF or OVMF can be split into FIRMWARE_VARS.fd (UEFI variables
@@ -750,11 +750,6 @@ dan_conf = "@DEFDANCONF@"
 # This is an experimental feature and might be removed in the future.
 experimental_force_guest_pull = @DEFFORCEGUESTPULL@
 
-# kubelet_root_dir is the kubelet root directory used to match ConfigMap/Secret
-# volume paths for propagation. Override for distros that use a different path
-# (e.g. k0s: /var/lib/k0s/kubelet).
-kubelet_root_dir = "@DEFKUBELETROOTDIR@"
-
 # pod_resource_api_sock specifies the unix socket for the Kubelet's
 # PodResource API endpoint. If empty, kubernetes based cold plug
 # will not be attempted. In order for this feature to work, the

src/runtime/config/configuration-qemu-nvidia-gpu-tdx.toml.in

@@ -76,7 +76,7 @@ kernel_verity_params = "@KERNELVERITYPARAMS_CONFIDENTIAL_NV@"
 
 # Path to the firmware.
 # If you want that qemu uses the default firmware leave this option empty
-firmware = "@FIRMWARETDVFPATH_NV@"
+firmware = "@FIRMWARETDVFPATH@"
 
 # Path to the firmware volume.
 # firmware TDVF or OVMF can be split into FIRMWARE_VARS.fd (UEFI variables
@@ -727,11 +727,6 @@ dan_conf = "@DEFDANCONF@"
 # This is an experimental feature and might be removed in the future.
 experimental_force_guest_pull = @DEFFORCEGUESTPULL@
 
-# kubelet_root_dir is the kubelet root directory used to match ConfigMap/Secret
-# volume paths for propagation. Override for distros that use a different path
-# (e.g. k0s: /var/lib/k0s/kubelet).
-kubelet_root_dir = "@DEFKUBELETROOTDIR@"
-
 # pod_resource_api_sock specifies the unix socket for the Kubelet's
 # PodResource API endpoint. If empty, kubernetes based cold plug
 # will not be attempted. In order for this feature to work, the

src/runtime/config/configuration-qemu-nvidia-gpu.toml.in

@@ -58,7 +58,7 @@ kernel_verity_params = "@KERNELVERITYPARAMS_NV@"
 
 # Path to the firmware.
 # If you want that qemu uses the default firmware leave this option empty
-firmware = "@FIRMWAREPATH_NV@"
+firmware = "@FIRMWAREPATH@"
 
 # Path to the firmware volume.
 # firmware TDVF or OVMF can be split into FIRMWARE_VARS.fd (UEFI variables
@@ -724,11 +724,6 @@ create_container_timeout = @DEFAULTTIMEOUT_NV@
 # (default: /run/kata-containers/dans)
 dan_conf = "@DEFDANCONF@"
 
-# kubelet_root_dir is the kubelet root directory used to match ConfigMap/Secret
-# volume paths for propagation. Override for distros that use a different path
-# (e.g. k0s: /var/lib/k0s/kubelet).
-kubelet_root_dir = "@DEFKUBELETROOTDIR@"
-
 # pod_resource_api_sock specifies the unix socket for the Kubelet's
 # PodResource API endpoint. If empty, kubernetes based cold plug
 # will not be attempted. In order for this feature to work, the

src/runtime/config/configuration-qemu-se.toml.in

@@ -712,11 +712,6 @@ dan_conf = "@DEFDANCONF@"
 # This is an experimental feature and might be removed in the future.
 experimental_force_guest_pull = @DEFFORCEGUESTPULL@
 
-# kubelet_root_dir is the kubelet root directory used to match ConfigMap/Secret
-# volume paths for propagation. Override for distros that use a different path
-# (e.g. k0s: /var/lib/k0s/kubelet).
-kubelet_root_dir = "@DEFKUBELETROOTDIR@"
-
 # pod_resource_api_sock specifies the unix socket for the Kubelet's
 # PodResource API endpoint. If empty, kubernetes based cold plug
 # will not be attempted. In order for this feature to work, the

src/runtime/config/configuration-qemu-snp.toml.in

@@ -737,11 +737,6 @@ dan_conf = "@DEFDANCONF@"
 # This is an experimental feature and might be removed in the future.
 experimental_force_guest_pull = @DEFFORCEGUESTPULL@
 
-# kubelet_root_dir is the kubelet root directory used to match ConfigMap/Secret
-# volume paths for propagation. Override for distros that use a different path
-# (e.g. k0s: /var/lib/k0s/kubelet).
-kubelet_root_dir = "@DEFKUBELETROOTDIR@"
-
 # pod_resource_api_sock specifies the unix socket for the Kubelet's
 # PodResource API endpoint. If empty, kubernetes based cold plug
 # will not be attempted. In order for this feature to work, the

src/runtime/config/configuration-qemu-tdx.toml.in

@@ -719,11 +719,6 @@ dan_conf = "@DEFDANCONF@"
 # This is an experimental feature and might be removed in the future.
 experimental_force_guest_pull = @DEFFORCEGUESTPULL@
 
-# kubelet_root_dir is the kubelet root directory used to match ConfigMap/Secret
-# volume paths for propagation. Override for distros that use a different path
-# (e.g. k0s: /var/lib/k0s/kubelet).
-kubelet_root_dir = "@DEFKUBELETROOTDIR@"
-
 # pod_resource_api_sock specifies the unix socket for the Kubelet's
 # PodResource API endpoint. If empty, kubernetes based cold plug
 # will not be attempted. In order for this feature to work, the

src/runtime/config/configuration-qemu.toml.in

@@ -723,11 +723,6 @@ create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
 # (default: /run/kata-containers/dans)
 dan_conf = "@DEFDANCONF@"
 
-# kubelet_root_dir is the kubelet root directory used to match ConfigMap/Secret
-# volume paths for propagation. Override for distros that use a different path
-# (e.g. k0s: /var/lib/k0s/kubelet).
-kubelet_root_dir = "@DEFKUBELETROOTDIR@"
-
 # pod_resource_api_sock specifies the unix socket for the Kubelet's
 # PodResource API endpoint. If empty, kubernetes based cold plug
 # will not be attempted. In order for this feature to work, the

src/runtime/config/configuration-remote.toml.in

@@ -290,11 +290,6 @@ create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
 # (default: /run/kata-containers/dans)
 dan_conf = "@DEFDANCONF@"
 
-# kubelet_root_dir is the kubelet root directory used to match ConfigMap/Secret
-# volume paths for propagation. Override for distros that use a different path
-# (e.g. k0s: /var/lib/k0s/kubelet).
-kubelet_root_dir = "@DEFKUBELETROOTDIR@"
-
 # pod_resource_api_sock specifies the unix socket for the Kubelet's
 # PodResource API endpoint. If empty, kubernetes based cold plug
 # will not be attempted. In order for this feature to work, the

src/runtime/config/configuration-stratovirt.toml.in

@@ -425,11 +425,6 @@ create_container_timeout = @DEFCREATECONTAINERTIMEOUT@
 # (default: /run/kata-containers/dans)
 dan_conf = "@DEFDANCONF@"
 
-# kubelet_root_dir is the kubelet root directory used to match ConfigMap/Secret
-# volume paths for propagation. Override for distros that use a different path
-# (e.g. k0s: /var/lib/k0s/kubelet).
-kubelet_root_dir = "@DEFKUBELETROOTDIR@"
-
 # pod_resource_api_sock specifies the unix socket for the Kubelet's
 # PodResource API endpoint. If empty, kubernetes based cold plug
 # will not be attempted. In order for this feature to work, the

src/runtime/go.mod

@@ -1,7 +1,7 @@
 module github.com/kata-containers/kata-containers/src/runtime
 
 // Keep in sync with version in versions.yaml
-go 1.25.7
+go 1.24.13
 
 // WARNING: Do NOT use `replace` directives as those break dependabot:
 // https://github.com/kata-containers/kata-containers/issues/11020
@@ -26,7 +26,7 @@ require (
 	github.com/docker/go-units v0.5.0
 	github.com/fsnotify/fsnotify v1.9.0
 	github.com/go-ini/ini v1.67.0
-	github.com/go-openapi/errors v0.22.1
+	github.com/go-openapi/errors v0.22.6
 	github.com/go-openapi/runtime v0.28.0
 	github.com/go-openapi/strfmt v0.23.0
 	github.com/go-openapi/swag v0.23.1
@@ -52,10 +52,11 @@ require (
 	github.com/urfave/cli v1.22.17
 	github.com/vishvananda/netlink v1.3.1
 	github.com/vishvananda/netns v0.0.5
-	go.opentelemetry.io/otel v1.40.0
+	gitlab.com/nvidia/cloud-native/go-nvlib v0.0.0-20220601114329-47893b162965
+	go.opentelemetry.io/otel v1.35.0
 	go.opentelemetry.io/otel/exporters/jaeger v1.0.0
-	go.opentelemetry.io/otel/sdk v1.40.0
-	go.opentelemetry.io/otel/trace v1.40.0
+	go.opentelemetry.io/otel/sdk v1.35.0
+	go.opentelemetry.io/otel/trace v1.35.0
 	golang.org/x/oauth2 v0.30.0
 	golang.org/x/sys v0.40.0
 	google.golang.org/grpc v1.72.0
@@ -126,9 +127,9 @@ require (
 	github.com/x448/float16 v0.8.4 // indirect
 	go.mongodb.org/mongo-driver v1.14.0 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 // indirect
-	go.opentelemetry.io/otel/metric v1.40.0 // indirect
+	go.opentelemetry.io/otel/metric v1.35.0 // indirect
 	golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f // indirect
 	golang.org/x/mod v0.31.0 // indirect
 	golang.org/x/net v0.49.0 // indirect

src/runtime/go.sum

@@ -107,8 +107,8 @@ github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-openapi/analysis v0.23.0 h1:aGday7OWupfMs+LbmLZG4k0MYXIANxcuBTYUC03zFCU=
 github.com/go-openapi/analysis v0.23.0/go.mod h1:9mz9ZWaSlV8TvjQHLl2mUW2PbZtemkE8yA5v22ohupo=
-github.com/go-openapi/errors v0.22.1 h1:kslMRRnK7NCb/CvR1q1VWuEQCEIsBGn5GgKD9e+HYhU=
-github.com/go-openapi/errors v0.22.1/go.mod h1:+n/5UdIqdVnLIJ6Q9Se8HNGUXYaY6CN8ImWzfi/Gzp0=
+github.com/go-openapi/errors v0.22.6 h1:eDxcf89O8odEnohIXwEjY1IB4ph5vmbUsBMsFNwXWPo=
+github.com/go-openapi/errors v0.22.6/go.mod h1:z9S8ASTUqx7+CP1Q8dD8ewGH/1JWFFLX/2PmAYNQLgk=
 github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
 github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
 github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
@@ -123,6 +123,8 @@ github.com/go-openapi/strfmt v0.23.0 h1:nlUS6BCqcnAk0pyhi9Y+kdDVZdZMHfEKQiS4HaMg
 github.com/go-openapi/strfmt v0.23.0/go.mod h1:NrtIpfKtWIygRkKVsxh7XQMDQW5HKQl6S5ik2elW+K4=
 github.com/go-openapi/swag v0.23.1 h1:lpsStH0n2ittzTnbaSloVZLuB5+fvSY/+hnagBjSNZU=
 github.com/go-openapi/swag v0.23.1/go.mod h1:STZs8TbRvEQQKUA+JZNAm3EWlgaOBGpyFDqQnDHMef0=
+github.com/go-openapi/testify/v2 v2.0.2 h1:X999g3jeLcoY8qctY/c/Z8iBHTbwLz7R2WXd6Ub6wls=
+github.com/go-openapi/testify/v2 v2.0.2/go.mod h1:HCPmvFFnheKK2BuwSA0TbbdxJ3I16pjwMkYkP4Ywn54=
 github.com/go-openapi/validate v0.24.0 h1:LdfDKwNbpB6Vn40xhTdNZAnfLECL81w+VX3BumrGD58=
 github.com/go-openapi/validate v0.24.0/go.mod h1:iyeX1sEufmv3nPbBdX3ieNviWnOZaJ1+zquzJEf2BAQ=
 github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI=
@@ -266,8 +268,8 @@ github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ
 github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
 github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/safchain/ethtool v0.6.2 h1:O3ZPFAKEUEfbtE6J/feEe2Ft7dIJ2Sy8t4SdMRiIMHY=
@@ -309,29 +311,31 @@ github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17
 github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+gitlab.com/nvidia/cloud-native/go-nvlib v0.0.0-20220601114329-47893b162965 h1:EXE1ZsUqiUWGV5Dw2oTYpXx24ffxj0//yhTB0Ppv+4s=
+gitlab.com/nvidia/cloud-native/go-nvlib v0.0.0-20220601114329-47893b162965/go.mod h1:TBB3sR7/jg4RCThC/cgT4fB8mAbbMO307TycfgeR59w=
 go.mongodb.org/mongo-driver v1.14.0 h1:P98w8egYRjYe3XDjxhYJagTokP/H6HzlsnojRgZRd80=
 go.mongodb.org/mongo-driver v1.14.0/go.mod h1:Vzb0Mk/pa7e6cWw85R4F/endUC3u0U9jGcNU603k65c=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
-go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
-go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 h1:CV7UdSGJt/Ao6Gp4CXckLxVRRsRgDHoI8XjbL3PDl8s=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0/go.mod h1:FRmFuRJfag1IZ2dPkHnEoSFVgTVPUd2qf5Vi69hLb8I=
 go.opentelemetry.io/otel v1.0.0/go.mod h1:AjRVh9A5/5DE7S+mZtTR6t8vpKKryam+0lREnfmS4cg=
-go.opentelemetry.io/otel v1.40.0 h1:oA5YeOcpRTXq6NN7frwmwFR0Cn3RhTVZvXsP4duvCms=
-go.opentelemetry.io/otel v1.40.0/go.mod h1:IMb+uXZUKkMXdPddhwAHm6UfOwJyh4ct1ybIlV14J0g=
+go.opentelemetry.io/otel v1.35.0 h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ=
+go.opentelemetry.io/otel v1.35.0/go.mod h1:UEqy8Zp11hpkUrL73gSlELM0DupHoiq72dR+Zqel/+Y=
 go.opentelemetry.io/otel/exporters/jaeger v1.0.0 h1:cLhx8llHw02h5JTqGqaRbYn+QVKHmrzD9vEbKnSPk5U=
 go.opentelemetry.io/otel/exporters/jaeger v1.0.0/go.mod h1:q10N1AolE1JjqKrFJK2tYw0iZpmX+HBaXBtuCzRnBGQ=
-go.opentelemetry.io/otel/metric v1.40.0 h1:rcZe317KPftE2rstWIBitCdVp89A2HqjkxR3c11+p9g=
-go.opentelemetry.io/otel/metric v1.40.0/go.mod h1:ib/crwQH7N3r5kfiBZQbwrTge743UDc7DTFVZrrXnqc=
+go.opentelemetry.io/otel/metric v1.35.0 h1:0znxYu2SNyuMSQT4Y9WDWej0VpcsxkuklLa4/siN90M=
+go.opentelemetry.io/otel/metric v1.35.0/go.mod h1:nKVFgxBZ2fReX6IlyW28MgZojkoAkJGaE8CpgeAU3oE=
 go.opentelemetry.io/otel/sdk v1.0.0/go.mod h1:PCrDHlSy5x1kjezSdL37PhbFUMjrsLRshJ2zCzeXwbM=
-go.opentelemetry.io/otel/sdk v1.40.0 h1:KHW/jUzgo6wsPh9At46+h4upjtccTmuZCFAc9OJ71f8=
-go.opentelemetry.io/otel/sdk v1.40.0/go.mod h1:Ph7EFdYvxq72Y8Li9q8KebuYUr2KoeyHx0DRMKrYBUE=
-go.opentelemetry.io/otel/sdk/metric v1.40.0 h1:mtmdVqgQkeRxHgRv4qhyJduP3fYJRMX4AtAlbuWdCYw=
-go.opentelemetry.io/otel/sdk/metric v1.40.0/go.mod h1:4Z2bGMf0KSK3uRjlczMOeMhKU2rhUqdWNoKcYrtcBPg=
+go.opentelemetry.io/otel/sdk v1.35.0 h1:iPctf8iprVySXSKJffSS79eOjl9pvxV9ZqOWT0QejKY=
+go.opentelemetry.io/otel/sdk v1.35.0/go.mod h1:+ga1bZliga3DxJ3CQGg3updiaAJoNECOgJREo9KHGQg=
+go.opentelemetry.io/otel/sdk/metric v1.34.0 h1:5CeK9ujjbFVL5c1PhLuStg1wxA7vQv7ce1EK0Gyvahk=
+go.opentelemetry.io/otel/sdk/metric v1.34.0/go.mod h1:jQ/r8Ze28zRKoNRdkjCZxfs6YvBTG1+YIqyFVFYec5w=
 go.opentelemetry.io/otel/trace v1.0.0/go.mod h1:PXTWqayeFUlJV1YDNhsJYB184+IvAH814St6o6ajzIs=
-go.opentelemetry.io/otel/trace v1.40.0 h1:WA4etStDttCSYuhwvEa8OP8I5EWu24lkOzp+ZYblVjw=
-go.opentelemetry.io/otel/trace v1.40.0/go.mod h1:zeAhriXecNGP/s2SEG3+Y8X9ujcJOTqQ5RgdEJcawiA=
+go.opentelemetry.io/otel/trace v1.35.0 h1:dPpEfJu1sDIqruz7BHFG3c7528f6ddfSWfFDVt/xgMs=
+go.opentelemetry.io/otel/trace v1.35.0/go.mod h1:WUk7DtFp1Aw2MkvqGdwiXYDZZNvA/1J8o6xRXLrIkyc=
 go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
 go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=

src/runtime/pkg/katautils/config.go

@@ -201,7 +201,6 @@ type runtime struct {
 	DanConf                   string   `toml:"dan_conf"`
 	ForceGuestPull            bool     `toml:"experimental_force_guest_pull"`
 	PodResourceAPISock        string   `toml:"pod_resource_api_sock"`
-	KubeletRootDir            string   `toml:"kubelet_root_dir"`
 }
 
 type agent struct {
@@ -1643,7 +1642,6 @@ func LoadConfiguration(configPath string, ignoreLogging bool) (resolvedConfigPat
 
 	config.ForceGuestPull = tomlConf.Runtime.ForceGuestPull
 	config.PodResourceAPISock = tomlConf.Runtime.PodResourceAPISock
-	config.KubeletRootDir = tomlConf.Runtime.KubeletRootDir
 
 	return resolved, config, nil
 }

src/runtime/pkg/oci/utils.go

@@ -193,10 +193,6 @@ type RuntimeConfig struct {
 	//	ColdPlugVFIO != NoPort AND PodResourceAPISock != "" => kubelet
 	//		based cold plug.
 	PodResourceAPISock string
-
-	// KubeletRootDir is the kubelet root directory used to match ConfigMap/Secret
-	// volume paths (e.g. /var/lib/k0s/kubelet for k0s). If empty, default is used.
-	KubeletRootDir string
 }
 
 // AddKernelParam allows the addition of new kernel parameters to an existing
@@ -1220,8 +1216,6 @@ func SandboxConfig(ocispec specs.Spec, runtime RuntimeConfig, bundlePath, cid st
 		CreateContainerTimeout: runtime.CreateContainerTimeout,
 
 		ForceGuestPull: runtime.ForceGuestPull,
-
-		KubeletRootDir: runtime.KubeletRootDir,
 	}
 
 	if err := addAnnotations(ocispec, &sandboxConfig, runtime); err != nil {

src/runtime/pkg/resourcecontrol/cgroups.go

@@ -186,15 +186,13 @@ func NewResourceController(path string, resources *specs.LinuxResources) (Resour
 	}, nil
 }
 
-func NewSandboxResourceController(path string, resources *specs.LinuxResources, sandboxCgroupOnly bool, needsHypervisorDevices bool) (ResourceController, error) {
+func NewSandboxResourceController(path string, resources *specs.LinuxResources, sandboxCgroupOnly bool) (ResourceController, error) {
 	sandboxResources := *resources
-	if needsHypervisorDevices {
-		sandboxDevs, err := sandboxDevices()
-		if err != nil {
-			return nil, err
-		}
-		sandboxResources.Devices = append(sandboxResources.Devices, sandboxDevs...)
+	sandboxDevices, err := sandboxDevices()
+	if err != nil {
+		return nil, err
 	}
+	sandboxResources.Devices = append(sandboxResources.Devices, sandboxDevices...)
 
 	// Currently we know to handle systemd cgroup path only when it's the only cgroup (no overhead group), hence,
 	// if sandboxCgroupOnly is not true we treat it as cgroupfs path as it used to be, although it may be incorrect.

src/runtime/pkg/resourcecontrol/cgroups_darwin.go

@@ -21,7 +21,7 @@ func NewResourceController(path string, resources *specs.LinuxResources) (Resour
 	return &DarwinResourceController{}, nil
 }
 
-func NewSandboxResourceController(path string, resources *specs.LinuxResources, sandboxCgroupOnly bool, needsHypervisorDevices bool) (ResourceController, error) {
+func NewSandboxResourceController(path string, resources *specs.LinuxResources, sandboxCgroupOnly bool) (ResourceController, error) {
 	return &DarwinResourceController{}, nil
 }
 

src/runtime/vendor/github.com/go-openapi/errors/.cliff.toml

@@ -0,0 +1,181 @@
+# git-cliff ~ configuration file
+# https://git-cliff.org/docs/configuration
+
+[changelog]
+header = """
+"""
+
+footer = """
+
+-----
+
+**[{{ remote.github.repo }}]({{ self::remote_url() }}) license terms**
+
+[![License][license-badge]][license-url]
+
+[license-badge]: http://img.shields.io/badge/license-Apache%20v2-orange.svg
+[license-url]: {{ self::remote_url() }}/?tab=Apache-2.0-1-ov-file#readme
+
+{%- macro remote_url() -%}
+  https://github.com/{{ remote.github.owner }}/{{ remote.github.repo }}
+{%- endmacro -%}
+"""
+
+body = """
+{%- if version %}
+## [{{ version | trim_start_matches(pat="v") }}]({{ self::remote_url() }}/tree/{{ version }}) - {{ timestamp | date(format="%Y-%m-%d") }}
+{%- else %}
+## [unreleased]
+{%- endif %}
+{%- if message %}
+  {%- raw %}\n{% endraw %}
+{{ message }}
+  {%- raw %}\n{% endraw %}
+{%- endif %}
+{%- if version %}
+  {%- if previous.version %}
+
+**Full Changelog**: <{{ self::remote_url() }}/compare/{{ previous.version }}...{{ version }}>
+  {%- endif %}
+{%- else %}
+  {%- raw %}\n{% endraw %}
+{%- endif %}
+
+{%- if statistics %}{% if statistics.commit_count %}
+  {%- raw %}\n{% endraw %}
+{{ statistics.commit_count }} commits in this release.
+  {%- raw %}\n{% endraw %}
+{%- endif %}{% endif %}
+-----
+
+{%- for group, commits in commits | group_by(attribute="group") %}
+  {%- raw %}\n{% endraw %}
+### {{ group | upper_first }}
+    {%- raw %}\n{% endraw %}
+    {%- for commit in commits %}
+      {%- if commit.remote.pr_title %}
+        {%- set commit_message = commit.remote.pr_title %}
+      {%- else %}
+        {%- set commit_message = commit.message %}
+      {%- endif %}
+* {{ commit_message | split(pat="\n") | first | trim }}
+      {%- if commit.remote.username %}
+{%- raw %} {% endraw %}by [@{{ commit.remote.username }}](https://github.com/{{ commit.remote.username }})
+      {%- endif %}
+      {%- if commit.remote.pr_number %}
+{%- raw %} {% endraw %}in [#{{ commit.remote.pr_number }}]({{ self::remote_url() }}/pull/{{ commit.remote.pr_number }})
+      {%- endif %}
+{%- raw %} {% endraw %}[...]({{ self::remote_url() }}/commit/{{ commit.id }})
+  {%- endfor %}
+{%- endfor %}
+
+{%- if github %}
+{%- raw %}\n{% endraw -%}
+  {%- set all_contributors = github.contributors | length %}
+  {%- if github.contributors | filter(attribute="username", value="dependabot[bot]") | length < all_contributors %}
+-----
+
+### People who contributed to this release
+  {% endif %}
+  {%- for contributor in github.contributors | filter(attribute="username") | sort(attribute="username") %}
+    {%- if contributor.username != "dependabot[bot]" and contributor.username != "github-actions[bot]" %}
+* [@{{ contributor.username }}](https://github.com/{{ contributor.username }})
+    {%- endif %}
+  {%- endfor %}
+
+  {% if github.contributors | filter(attribute="is_first_time", value=true) | length != 0 %}
+-----
+    {%- raw %}\n{% endraw %}
+
+### New Contributors
+  {%- endif %}
+
+  {%- for contributor in github.contributors | filter(attribute="is_first_time", value=true) %}
+    {%- if contributor.username != "dependabot[bot]" and contributor.username != "github-actions[bot]" %}
+* @{{ contributor.username }} made their first contribution
+      {%- if contributor.pr_number %}
+  in [#{{ contributor.pr_number }}]({{ self::remote_url() }}/pull/{{ contributor.pr_number }}) \
+      {%- endif %}
+    {%- endif %}
+  {%- endfor %}
+{%- endif %}
+
+{%- raw %}\n{% endraw %}
+
+{%- macro remote_url() -%}
+  https://github.com/{{ remote.github.owner }}/{{ remote.github.repo }}
+{%- endmacro -%}
+"""
+# Remove leading and trailing whitespaces from the changelog's body.
+trim = true
+# Render body even when there are no releases to process.
+render_always = true
+# An array of regex based postprocessors to modify the changelog.
+postprocessors = [
+    # Replace the placeholder <REPO> with a URL.
+    #{ pattern = '<REPO>', replace = "https://github.com/orhun/git-cliff" },
+]
+# output file path
+# output = "test.md"
+
+[git]
+# Parse commits according to the conventional commits specification.
+# See https://www.conventionalcommits.org
+conventional_commits = false
+# Exclude commits that do not match the conventional commits specification.
+filter_unconventional = false
+# Require all commits to be conventional.
+# Takes precedence over filter_unconventional.
+require_conventional = false
+# Split commits on newlines, treating each line as an individual commit.
+split_commits = false
+# An array of regex based parsers to modify commit messages prior to further processing.
+commit_preprocessors = [
+    # Replace issue numbers with link templates to be updated in `changelog.postprocessors`.
+    #{ pattern = '\((\w+\s)?#([0-9]+)\)', replace = "([#${2}](<REPO>/issues/${2}))"},
+    # Check spelling of the commit message using https://github.com/crate-ci/typos.
+    # If the spelling is incorrect, it will be fixed automatically.
+    #{ pattern = '.*', replace_command = 'typos --write-changes -' }
+]
+# Prevent commits that are breaking from being excluded by commit parsers.
+protect_breaking_commits = false
+# An array of regex based parsers for extracting data from the commit message.
+# Assigns commits to groups.
+# Optionally sets the commit's scope and can decide to exclude commits from further processing.
+commit_parsers = [
+    { message = "^[Cc]hore\\([Rr]elease\\): prepare for", skip = true },
+    { message = "(^[Mm]erge)|([Mm]erge conflict)", skip = true },
+    { field = "author.name", pattern = "dependabot*", group = "<!-- 0A -->Updates" },
+    { message = "([Ss]ecurity)|([Vv]uln)", group = "<!-- 08 -->Security" },
+    { body = "(.*[Ss]ecurity)|([Vv]uln)", group = "<!-- 08 -->Security" },
+    { message = "([Cc]hore\\(lint\\))|(style)|(lint)|(codeql)|(golangci)", group = "<!-- 05 -->Code quality" },
+    { message = "(^[Dd]oc)|((?i)readme)|(badge)|(typo)|(documentation)", group = "<!-- 03 -->Documentation" },
+    { message = "(^[Ff]eat)|(^[Ee]nhancement)", group = "<!-- 00 -->Implemented enhancements" },
+    { message = "(^ci)|(\\(ci\\))|(fixup\\s+ci)|(fix\\s+ci)|(license)|(example)", group = "<!-- 07 -->Miscellaneous tasks" },
+    { message = "^test", group = "<!-- 06 -->Testing" },
+    { message = "(^fix)|(panic)", group = "<!-- 01 -->Fixed bugs" },
+    { message = "(^refact)|(rework)", group = "<!-- 02 -->Refactor" },
+    { message = "(^[Pp]erf)|(performance)", group = "<!-- 04 -->Performance" },
+    { message = "(^[Cc]hore)", group = "<!-- 07 -->Miscellaneous tasks" },
+    { message = "^[Rr]evert", group = "<!-- 09 -->Reverted changes" },
+    { message = "(upgrade.*?go)|(go\\s+version)", group = "<!-- 0A -->Updates" },
+    { message = ".*", group = "<!-- 0B -->Other" },
+]
+# Exclude commits that are not matched by any commit parser.
+filter_commits = false
+# An array of link parsers for extracting external references, and turning them into URLs, using regex.
+link_parsers = []
+# Include only the tags that belong to the current branch.
+use_branch_tags = false
+# Order releases topologically instead of chronologically.
+topo_order = false
+# Order releases topologically instead of chronologically.
+topo_order_commits = true
+# Order of commits in each group/release within the changelog.
+# Allowed values: newest, oldest
+sort_commits = "newest"
+# Process submodules commits
+recurse_submodules = false
+
+#[remote.github]
+#owner = "go-openapi"

src/runtime/vendor/github.com/go-openapi/errors/.editorconfig

@@ -0,0 +1,26 @@
+# top-most EditorConfig file
+root = true
+
+# Unix-style newlines with a newline ending every file
+[*]
+end_of_line = lf
+insert_final_newline = true
+indent_style = space
+indent_size = 2
+trim_trailing_whitespace = true
+
+# Set default charset
+[*.{js,py,go,scala,rb,java,html,css,less,sass,md}]
+charset = utf-8
+
+# Tab indentation (no size specified)
+[*.go]
+indent_style = tab
+
+[*.md]
+trim_trailing_whitespace = false
+
+# Matches the exact files either package.json or .travis.yml
+[{package.json,.travis.yml}]
+indent_style = space
+indent_size = 2

src/runtime/vendor/github.com/go-openapi/errors/.gitignore

@@ -1,2 +1,3 @@
 secrets.yml
-coverage.out
+*.out
+settings.local.json

src/runtime/vendor/github.com/go-openapi/errors/.golangci.yml

@@ -1,55 +1,66 @@
-linters-settings:
-  gocyclo:
-    min-complexity: 45
-  dupl:
-    threshold: 200
-  goconst:
-    min-len: 2
-    min-occurrences: 3
-
+version: "2"
 linters:
-  enable-all: true
+  default: all
   disable:
-    - unparam
-    - lll
-    - gochecknoinits
-    - gochecknoglobals
+    - depguard
     - funlen
     - godox
-    - gocognit
-    - whitespace
-    - wsl
-    - wrapcheck
-    - testpackage
-    - nlreturn
-    - errorlint
-    - nestif
-    - godot
-    - gofumpt
-    - paralleltest
-    - tparallel
-    - thelper
     - exhaustruct
-    - varnamelen
-    - gci
-    - depguard
-    - errchkjson
-    - inamedparam
+    - nlreturn
     - nonamedreturns
-    - musttag
-    - ireturn
-    - forcetypeassert
-    - cyclop
-    # deprecated linters
-    #- deadcode
-    #- interfacer
-    #- scopelint
-    #- varcheck
-    #- structcheck
-    #- golint
-    #- nosnakecase
-    #- maligned
-    #- goerr113
-    #- ifshort
-    #- gomnd
-    #- exhaustivestruct
+    - noinlineerr
+    - paralleltest
+    - recvcheck
+    - testpackage
+    - tparallel
+    - varnamelen
+    - whitespace
+    - wrapcheck
+    - wsl
+    - wsl_v5
+  settings:
+    dupl:
+      threshold: 200
+    goconst:
+      min-len: 2
+      min-occurrences: 3
+    cyclop:
+      max-complexity: 20
+    gocyclo:
+      min-complexity: 20
+    exhaustive:
+      default-signifies-exhaustive: true
+      default-case-required: true
+    lll:
+      line-length: 180
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  enable:
+    - gofmt
+    - goimports
+    - gofumpt
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+issues:
+  # Maximum issues count per one linter.
+  # Set to 0 to disable.
+  # Default: 50
+  max-issues-per-linter: 0
+  # Maximum count of issues with the same text.
+  # Set to 0 to disable.
+  # Default: 3
+  max-same-issues: 0

src/runtime/vendor/github.com/go-openapi/errors/CONTRIBUTORS.md

@@ -0,0 +1,24 @@
+# Contributors
+
+- Repository: ['go-openapi/errors']
+
+| Total Contributors | Total Contributions |
+| --- | --- |
+| 12  | 105  |
+
+| Username | All Time Contribution Count | All Commits |
+| --- | --- | --- |
+| @casualjim | 58 | https://github.com/go-openapi/errors/commits?author=casualjim |
+| @fredbi | 32 | https://github.com/go-openapi/errors/commits?author=fredbi |
+| @youyuanwu | 5 | https://github.com/go-openapi/errors/commits?author=youyuanwu |
+| @alexandear | 2 | https://github.com/go-openapi/errors/commits?author=alexandear |
+| @fiorix | 1 | https://github.com/go-openapi/errors/commits?author=fiorix |
+| @ligustah | 1 | https://github.com/go-openapi/errors/commits?author=ligustah |
+| @artemseleznev | 1 | https://github.com/go-openapi/errors/commits?author=artemseleznev |
+| @gautierdelorme | 1 | https://github.com/go-openapi/errors/commits?author=gautierdelorme |
+| @guillemj | 1 | https://github.com/go-openapi/errors/commits?author=guillemj |
+| @maxatome | 1 | https://github.com/go-openapi/errors/commits?author=maxatome |
+| @Simon-Li | 1 | https://github.com/go-openapi/errors/commits?author=Simon-Li |
+| @ujjwalsh | 1 | https://github.com/go-openapi/errors/commits?author=ujjwalsh |
+
+ _this file was generated by the [Contributors GitHub Action](https://github.com/github/contributors)_

src/runtime/vendor/github.com/go-openapi/errors/README.md

@@ -1,8 +1,123 @@
-# OpenAPI errors [![Build Status](https://github.com/go-openapi/errors/actions/workflows/go-test.yml/badge.svg)](https://github.com/go-openapi/errors/actions?query=workflow%3A"go+test") [![codecov](https://codecov.io/gh/go-openapi/errors/branch/master/graph/badge.svg)](https://codecov.io/gh/go-openapi/errors)
+# errors
 
-[![Slack Status](https://slackin.goswagger.io/badge.svg)](https://slackin.goswagger.io)
-[![license](http://img.shields.io/badge/license-Apache%20v2-orange.svg)](https://raw.githubusercontent.com/go-openapi/errors/master/LICENSE)
-[![Go Reference](https://pkg.go.dev/badge/github.com/go-openapi/errors.svg)](https://pkg.go.dev/github.com/go-openapi/errors)
-[![Go Report Card](https://goreportcard.com/badge/github.com/go-openapi/errors)](https://goreportcard.com/report/github.com/go-openapi/errors)
+<!-- Badges: status  -->
+[![Tests][test-badge]][test-url] [![Coverage][cov-badge]][cov-url] [![CI vuln scan][vuln-scan-badge]][vuln-scan-url] [![CodeQL][codeql-badge]][codeql-url]
+<!-- Badges: release & docker images  -->
+<!-- Badges: code quality  -->
+<!-- Badges: license & compliance -->
+[![Release][release-badge]][release-url] [![Go Report Card][gocard-badge]][gocard-url] [![CodeFactor Grade][codefactor-badge]][codefactor-url] [![License][license-badge]][license-url]
+<!-- Badges: documentation & support -->
+<!-- Badges: others & stats -->
+[![GoDoc][godoc-badge]][godoc-url] [![Discord Channel][discord-badge]][discord-url] [![go version][goversion-badge]][goversion-url] ![Top language][top-badge] ![Commits since latest release][commits-badge]
+
+---
 
 Shared errors and error interface used throughout the various libraries found in the go-openapi toolkit.
+
+## Announcements
+
+* **2025-12-19** : new community chat on discord
+  * a new discord community channel is available to be notified of changes and support users
+  * our venerable Slack channel remains open, and will be eventually discontinued on **2026-03-31**
+
+You may join the discord community by clicking the invite link on the discord badge (also above). [![Discord Channel][discord-badge]][discord-url]
+
+Or join our Slack channel: [![Slack Channel][slack-logo]![slack-badge]][slack-url]
+
+## Status
+
+API is stable.
+
+## Import this library in your project
+
+```cmd
+go get github.com/go-openapi/errors
+```
+
+## Basic usage
+
+```go
+const url = "https://www.example.com/#"
+
+errGeneric := New(401,"onvalid argument: %s", url)
+
+errNotFound := NotFound("resource not found: %s", url)
+
+errNotImplemented := NotImplemented("method: %s", url)
+```
+
+## Change log
+
+See <https://github.com/go-openapi/errors/releases>
+
+<!--
+## References
+-->
+
+## Licensing
+
+This library ships under the [SPDX-License-Identifier: Apache-2.0](./LICENSE).
+
+<!--
+See the license [NOTICE](./NOTICE), which recalls the licensing terms of all the pieces of software
+on top of which it has been built.
+-->
+
+<!--
+## Limitations
+-->
+
+## Other documentation
+
+* [All-time contributors](./CONTRIBUTORS.md)
+* [Contributing guidelines](.github/CONTRIBUTING.md)
+* [Maintainers documentation](docs/MAINTAINERS.md)
+* [Code style](docs/STYLE.md)
+
+## Cutting a new release
+
+Maintainers can cut a new release by either:
+
+* running [this workflow](https://github.com/go-openapi/errors/actions/workflows/bump-release.yml)
+* or pushing a semver tag
+  * signed tags are preferred
+  * The tag message is prepended to release notes
+
+<!-- Badges: status  -->
+[test-badge]: https://github.com/go-openapi/errors/actions/workflows/go-test.yml/badge.svg
+[test-url]: https://github.com/go-openapi/errors/actions/workflows/go-test.yml
+[cov-badge]: https://codecov.io/gh/go-openapi/errors/branch/master/graph/badge.svg
+[cov-url]: https://codecov.io/gh/go-openapi/errors
+[vuln-scan-badge]: https://github.com/go-openapi/errors/actions/workflows/scanner.yml/badge.svg
+[vuln-scan-url]: https://github.com/go-openapi/errors/actions/workflows/scanner.yml
+[codeql-badge]: https://github.com/go-openapi/errors/actions/workflows/codeql.yml/badge.svg
+[codeql-url]: https://github.com/go-openapi/errors/actions/workflows/codeql.yml
+<!-- Badges: release & docker images  -->
+[release-badge]: https://badge.fury.io/gh/go-openapi%2Ferrors.svg
+[release-url]: https://badge.fury.io/gh/go-openapi%2Ferrors
+[gomod-badge]: https://badge.fury.io/go/github.com%2Fgo-openapi%2Ferrors.svg
+[gomod-url]: https://badge.fury.io/go/github.com%2Fgo-openapi%2Ferrors
+<!-- Badges: code quality  -->
+[gocard-badge]: https://goreportcard.com/badge/github.com/go-openapi/errors
+[gocard-url]: https://goreportcard.com/report/github.com/go-openapi/errors
+[codefactor-badge]: https://img.shields.io/codefactor/grade/github/go-openapi/errors
+[codefactor-url]: https://www.codefactor.io/repository/github/go-openapi/errors
+<!-- Badges: documentation & support -->
+[doc-badge]: https://img.shields.io/badge/doc-site-blue?link=https%3A%2F%2Fgoswagger.io%2Fgo-openapi%2F
+[doc-url]: https://goswagger.io/go-openapi
+[godoc-badge]: https://pkg.go.dev/badge/github.com/go-openapi/errors
+[godoc-url]: http://pkg.go.dev/github.com/go-openapi/errors
+[slack-logo]: https://a.slack-edge.com/e6a93c1/img/icons/favicon-32.png
+[slack-badge]: https://img.shields.io/badge/slack-blue?link=https%3A%2F%2Fgoswagger.slack.com%2Farchives%2FC04R30YM
+[slack-url]: https://goswagger.slack.com/archives/C04R30YMU
+[discord-badge]: https://img.shields.io/discord/1446918742398341256?logo=discord&label=discord&color=blue
+[discord-url]: https://discord.gg/DrafRmZx
+
+<!-- Badges: license & compliance -->
+[license-badge]: http://img.shields.io/badge/license-Apache%20v2-orange.svg
+[license-url]: https://github.com/go-openapi/errors/?tab=Apache-2.0-1-ov-file#readme
+<!-- Badges: others & stats -->
+[goversion-badge]: https://img.shields.io/github/go-mod/go-version/go-openapi/errors
+[goversion-url]: https://github.com/go-openapi/errors/blob/master/go.mod
+[top-badge]: https://img.shields.io/github/languages/top/go-openapi/errors
+[commits-badge]: https://img.shields.io/github/commits-since/go-openapi/errors/latest

src/runtime/vendor/github.com/go-openapi/errors/SECURITY.md

@@ -0,0 +1,19 @@
+# Security Policy
+
+This policy outlines the commitment and practices of the go-openapi maintainers regarding security.
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 0.22.x  | :white_check_mark: |
+
+## Reporting a vulnerability
+
+If you become aware of a security vulnerability that affects the current repository,
+please report it privately to the maintainers.
+
+Please follow the instructions provided by github to
+[Privately report a security vulnerability](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability).
+
+TL;DR: on Github, navigate to the project's "Security" tab then click on "Report a vulnerability".

src/runtime/vendor/github.com/go-openapi/errors/api.go

@@ -1,21 +1,11 @@
-// Copyright 2015 go-swagger maintainers
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//    http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
 
 package errors
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/http"
 	"reflect"
@@ -23,9 +13,11 @@ import (
 )
 
 // DefaultHTTPCode is used when the error Code cannot be used as an HTTP code.
+//
+//nolint:gochecknoglobals // it should have been a constant in the first place, but now it is mutable so we have to leave it here or introduce a breaking change.
 var DefaultHTTPCode = http.StatusUnprocessableEntity
 
-// Error represents a error interface all swagger framework errors implement
+// Error represents a error interface all swagger framework errors implement.
 type Error interface {
 	error
 	Code() int32
@@ -36,24 +28,26 @@ type apiError struct {
 	message string
 }
 
+// Error implements the standard error interface.
 func (a *apiError) Error() string {
 	return a.message
 }
 
+// Code returns the HTTP status code associated with this error.
 func (a *apiError) Code() int32 {
 	return a.code
 }
 
-// MarshalJSON implements the JSON encoding interface
+// MarshalJSON implements the JSON encoding interface.
 func (a apiError) MarshalJSON() ([]byte, error) {
-	return json.Marshal(map[string]interface{}{
+	return json.Marshal(map[string]any{
 		"code":    a.code,
 		"message": a.message,
 	})
 }
 
-// New creates a new API error with a code and a message
-func New(code int32, message string, args ...interface{}) Error {
+// New creates a new API error with a code and a message.
+func New(code int32, message string, args ...any) Error {
 	if len(args) > 0 {
 		return &apiError{
 			code:    code,
@@ -66,38 +60,39 @@ func New(code int32, message string, args ...interface{}) Error {
 	}
 }
 
-// NotFound creates a new not found error
-func NotFound(message string, args ...interface{}) Error {
+// NotFound creates a new not found error.
+func NotFound(message string, args ...any) Error {
 	if message == "" {
 		message = "Not found"
 	}
-	return New(http.StatusNotFound, fmt.Sprintf(message, args...))
+	return New(http.StatusNotFound, message, args...)
 }
 
-// NotImplemented creates a new not implemented error
+// NotImplemented creates a new not implemented error.
 func NotImplemented(message string) Error {
-	return New(http.StatusNotImplemented, message)
+	return New(http.StatusNotImplemented, "%s", message)
 }
 
-// MethodNotAllowedError represents an error for when the path matches but the method doesn't
+// MethodNotAllowedError represents an error for when the path matches but the method doesn't.
 type MethodNotAllowedError struct {
 	code    int32
 	Allowed []string
 	message string
 }
 
+// Error implements the standard error interface.
 func (m *MethodNotAllowedError) Error() string {
 	return m.message
 }
 
-// Code the error code
+// Code returns 405 (Method Not Allowed) as the HTTP status code.
 func (m *MethodNotAllowedError) Code() int32 {
 	return m.code
 }
 
-// MarshalJSON implements the JSON encoding interface
+// MarshalJSON implements the JSON encoding interface.
 func (m MethodNotAllowedError) MarshalJSON() ([]byte, error) {
-	return json.Marshal(map[string]interface{}{
+	return json.Marshal(map[string]any{
 		"code":    m.code,
 		"message": m.message,
 		"allowed": m.Allowed,
@@ -115,25 +110,33 @@ func errorAsJSON(err Error) []byte {
 
 func flattenComposite(errs *CompositeError) *CompositeError {
 	var res []error
-	for _, er := range errs.Errors {
-		switch e := er.(type) {
-		case *CompositeError:
-			if e != nil && len(e.Errors) > 0 {
-				flat := flattenComposite(e)
-				if len(flat.Errors) > 0 {
-					res = append(res, flat.Errors...)
-				}
-			}
-		default:
-			if e != nil {
-				res = append(res, e)
-			}
+
+	for _, err := range errs.Errors {
+		if err == nil {
+			continue
 		}
+
+		e := &CompositeError{}
+		if !errors.As(err, &e) {
+			res = append(res, err)
+
+			continue
+		}
+
+		if len(e.Errors) == 0 {
+			res = append(res, e)
+
+			continue
+		}
+
+		flat := flattenComposite(e)
+		res = append(res, flat.Errors...)
 	}
+
 	return CompositeValidationError(res...)
 }
 
-// MethodNotAllowed creates a new method not allowed error
+// MethodNotAllowed creates a new method not allowed error.
 func MethodNotAllowed(requested string, allow []string) Error {
 	msg := fmt.Sprintf("method %s is not allowed, but [%s] are", requested, strings.Join(allow, ","))
 	return &MethodNotAllowedError{
@@ -143,43 +146,59 @@ func MethodNotAllowed(requested string, allow []string) Error {
 	}
 }
 
-// ServeError implements the http error handler interface
+// ServeError implements the http error handler interface.
 func ServeError(rw http.ResponseWriter, r *http.Request, err error) {
 	rw.Header().Set("Content-Type", "application/json")
-	switch e := err.(type) {
-	case *CompositeError:
-		er := flattenComposite(e)
+
+	if err == nil {
+		rw.WriteHeader(http.StatusInternalServerError)
+		_, _ = rw.Write(errorAsJSON(New(http.StatusInternalServerError, "Unknown error")))
+
+		return
+	}
+
+	errComposite := &CompositeError{}
+	errMethodNotAllowed := &MethodNotAllowedError{}
+	var errError Error
+
+	switch {
+	case errors.As(err, &errComposite):
+		er := flattenComposite(errComposite)
 		// strips composite errors to first element only
 		if len(er.Errors) > 0 {
 			ServeError(rw, r, er.Errors[0])
-		} else {
-			// guard against empty CompositeError (invalid construct)
-			ServeError(rw, r, nil)
+
+			return
 		}
-	case *MethodNotAllowedError:
-		rw.Header().Add("Allow", strings.Join(e.Allowed, ","))
-		rw.WriteHeader(asHTTPCode(int(e.Code())))
+
+		// guard against empty CompositeError (invalid construct)
+		ServeError(rw, r, nil)
+
+	case errors.As(err, &errMethodNotAllowed):
+		rw.Header().Add("Allow", strings.Join(errMethodNotAllowed.Allowed, ","))
+		rw.WriteHeader(asHTTPCode(int(errMethodNotAllowed.Code())))
 		if r == nil || r.Method != http.MethodHead {
-			_, _ = rw.Write(errorAsJSON(e))
+			_, _ = rw.Write(errorAsJSON(errMethodNotAllowed))
 		}
-	case Error:
-		value := reflect.ValueOf(e)
+
+	case errors.As(err, &errError):
+		value := reflect.ValueOf(errError)
 		if value.Kind() == reflect.Ptr && value.IsNil() {
 			rw.WriteHeader(http.StatusInternalServerError)
 			_, _ = rw.Write(errorAsJSON(New(http.StatusInternalServerError, "Unknown error")))
+
 			return
 		}
-		rw.WriteHeader(asHTTPCode(int(e.Code())))
+
+		rw.WriteHeader(asHTTPCode(int(errError.Code())))
 		if r == nil || r.Method != http.MethodHead {
-			_, _ = rw.Write(errorAsJSON(e))
+			_, _ = rw.Write(errorAsJSON(errError))
 		}
-	case nil:
-		rw.WriteHeader(http.StatusInternalServerError)
-		_, _ = rw.Write(errorAsJSON(New(http.StatusInternalServerError, "Unknown error")))
+
 	default:
 		rw.WriteHeader(http.StatusInternalServerError)
 		if r == nil || r.Method != http.MethodHead {
-			_, _ = rw.Write(errorAsJSON(New(http.StatusInternalServerError, err.Error())))
+			_, _ = rw.Write(errorAsJSON(New(http.StatusInternalServerError, "%v", err)))
 		}
 	}
 }

src/runtime/vendor/github.com/go-openapi/errors/auth.go

@@ -1,22 +1,11 @@
-// Copyright 2015 go-swagger maintainers
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//    http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
 
 package errors
 
 import "net/http"
 
-// Unauthenticated returns an unauthenticated error
+// Unauthenticated returns an unauthenticated error.
 func Unauthenticated(scheme string) Error {
 	return New(http.StatusUnauthorized, "unauthenticated for %s", scheme)
 }

src/runtime/vendor/github.com/go-openapi/errors/doc.go

@@ -1,16 +1,5 @@
-// Copyright 2015 go-swagger maintainers
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//    http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
 
 /*
 Package errors provides an Error interface and several concrete types

src/runtime/vendor/github.com/go-openapi/errors/headers.go

@@ -1,16 +1,5 @@
-// Copyright 2015 go-swagger maintainers
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//    http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
 
 package errors
 
@@ -20,28 +9,30 @@ import (
 	"net/http"
 )
 
-// Validation represents a failure of a precondition
-type Validation struct { //nolint: errname
+// Validation represents a failure of a precondition.
+type Validation struct { //nolint: errname // changing the name to abide by the naming rule would bring a breaking change.
 	code    int32
 	Name    string
 	In      string
-	Value   interface{}
+	Value   any
 	message string
-	Values  []interface{}
+	Values  []any
 }
 
+// Error implements the standard error interface.
 func (e *Validation) Error() string {
 	return e.message
 }
 
-// Code the error code
+// Code returns the HTTP status code for this validation error.
+// Returns 422 (Unprocessable Entity) by default.
 func (e *Validation) Code() int32 {
 	return e.code
 }
 
-// MarshalJSON implements the JSON encoding interface
+// MarshalJSON implements the JSON encoding interface.
 func (e Validation) MarshalJSON() ([]byte, error) {
-	return json.Marshal(map[string]interface{}{
+	return json.Marshal(map[string]any{
 		"code":    e.code,
 		"message": e.message,
 		"in":      e.In,
@@ -51,7 +42,7 @@ func (e Validation) MarshalJSON() ([]byte, error) {
 	})
 }
 
-// ValidateName sets the name for a validation or updates it for a nested property
+// ValidateName sets the name for a validation or updates it for a nested property.
 func (e *Validation) ValidateName(name string) *Validation {
 	if name != "" {
 		if e.Name == "" {
@@ -70,9 +61,9 @@ const (
 	responseFormatFail = `unsupported media type requested, only %v are available`
 )
 
-// InvalidContentType error for an invalid content type
+// InvalidContentType error for an invalid content type.
 func InvalidContentType(value string, allowed []string) *Validation {
-	values := make([]interface{}, 0, len(allowed))
+	values := make([]any, 0, len(allowed))
 	for _, v := range allowed {
 		values = append(values, v)
 	}
@@ -86,9 +77,9 @@ func InvalidContentType(value string, allowed []string) *Validation {
 	}
 }
 
-// InvalidResponseFormat error for an unacceptable response format request
+// InvalidResponseFormat error for an unacceptable response format request.
 func InvalidResponseFormat(value string, allowed []string) *Validation {
-	values := make([]interface{}, 0, len(allowed))
+	values := make([]any, 0, len(allowed))
 	for _, v := range allowed {
 		values = append(values, v)
 	}

src/runtime/vendor/github.com/go-openapi/errors/middleware.go

@@ -1,16 +1,5 @@
-// Copyright 2015 go-swagger maintainers
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//    http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
 
 package errors
 
@@ -21,13 +10,14 @@ import (
 )
 
 // APIVerificationFailed is an error that contains all the missing info for a mismatched section
-// between the api registrations and the api spec
+// between the api registrations and the api spec.
 type APIVerificationFailed struct { //nolint: errname
 	Section              string   `json:"section,omitempty"`
 	MissingSpecification []string `json:"missingSpecification,omitempty"`
 	MissingRegistration  []string `json:"missingRegistration,omitempty"`
 }
 
+// Error implements the standard error interface.
 func (v *APIVerificationFailed) Error() string {
 	buf := bytes.NewBuffer(nil)
 
@@ -35,7 +25,7 @@ func (v *APIVerificationFailed) Error() string {
 	hasSpecMissing := len(v.MissingSpecification) > 0
 
 	if hasRegMissing {
-		buf.WriteString(fmt.Sprintf("missing [%s] %s registrations", strings.Join(v.MissingRegistration, ", "), v.Section))
+		fmt.Fprintf(buf, "missing [%s] %s registrations", strings.Join(v.MissingRegistration, ", "), v.Section)
 	}
 
 	if hasRegMissing && hasSpecMissing {
@@ -43,7 +33,7 @@ func (v *APIVerificationFailed) Error() string {
 	}
 
 	if hasSpecMissing {
-		buf.WriteString(fmt.Sprintf("missing from spec file [%s] %s", strings.Join(v.MissingSpecification, ", "), v.Section))
+		fmt.Fprintf(buf, "missing from spec file [%s] %s", strings.Join(v.MissingSpecification, ", "), v.Section)
 	}
 
 	return buf.String()

src/runtime/vendor/github.com/go-openapi/errors/parsing.go

@@ -1,16 +1,5 @@
-// Copyright 2015 go-swagger maintainers
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//    http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
 
 package errors
 
@@ -20,7 +9,7 @@ import (
 	"net/http"
 )
 
-// ParseError represents a parsing error
+// ParseError represents a parsing error.
 type ParseError struct {
 	code    int32
 	Name    string
@@ -30,37 +19,7 @@ type ParseError struct {
 	message string
 }
 
-func (e *ParseError) Error() string {
-	return e.message
-}
-
-// Code returns the http status code for this error
-func (e *ParseError) Code() int32 {
-	return e.code
-}
-
-// MarshalJSON implements the JSON encoding interface
-func (e ParseError) MarshalJSON() ([]byte, error) {
-	var reason string
-	if e.Reason != nil {
-		reason = e.Reason.Error()
-	}
-	return json.Marshal(map[string]interface{}{
-		"code":    e.code,
-		"message": e.message,
-		"in":      e.In,
-		"name":    e.Name,
-		"value":   e.Value,
-		"reason":  reason,
-	})
-}
-
-const (
-	parseErrorTemplContent     = `parsing %s %s from %q failed, because %s`
-	parseErrorTemplContentNoIn = `parsing %s from %q failed, because %s`
-)
-
-// NewParseError creates a new parse error
+// NewParseError creates a new parse error.
 func NewParseError(name, in, value string, reason error) *ParseError {
 	var msg string
 	if in == "" {
@@ -77,3 +36,34 @@ func NewParseError(name, in, value string, reason error) *ParseError {
 		message: msg,
 	}
 }
+
+// Error implements the standard error interface.
+func (e *ParseError) Error() string {
+	return e.message
+}
+
+// Code returns 400 (Bad Request) as the HTTP status code for parsing errors.
+func (e *ParseError) Code() int32 {
+	return e.code
+}
+
+// MarshalJSON implements the JSON encoding interface.
+func (e ParseError) MarshalJSON() ([]byte, error) {
+	var reason string
+	if e.Reason != nil {
+		reason = e.Reason.Error()
+	}
+	return json.Marshal(map[string]any{
+		"code":    e.code,
+		"message": e.message,
+		"in":      e.In,
+		"name":    e.Name,
+		"value":   e.Value,
+		"reason":  reason,
+	})
+}
+
+const (
+	parseErrorTemplContent     = `parsing %s %s from %q failed, because %s`
+	parseErrorTemplContentNoIn = `parsing %s from %q failed, because %s`
+)

src/runtime/vendor/github.com/go-openapi/errors/schema.go

@@ -1,21 +1,11 @@
-// Copyright 2015 go-swagger maintainers
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//    http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
+// SPDX-License-Identifier: Apache-2.0
 
 package errors
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/http"
 	"strings"
@@ -73,14 +63,15 @@ const (
 const maximumValidHTTPCode = 600
 
 // All code responses can be used to differentiate errors for different handling
-// by the consuming program
+// by the consuming program.
 const (
 	// CompositeErrorCode remains 422 for backwards-compatibility
-	// and to separate it from validation errors with cause
+	// and to separate it from validation errors with cause.
 	CompositeErrorCode = http.StatusUnprocessableEntity
 
-	// InvalidTypeCode is used for any subclass of invalid types
+	// InvalidTypeCode is used for any subclass of invalid types.
 	InvalidTypeCode = maximumValidHTTPCode + iota
+	// RequiredFailCode indicates a required field is missing.
 	RequiredFailCode
 	TooLongFailCode
 	TooShortFailCode
@@ -101,22 +92,26 @@ const (
 	ReadOnlyFailCode
 )
 
-// CompositeError is an error that groups several errors together
+// CompositeError is an error that groups several errors together.
 type CompositeError struct {
 	Errors  []error
 	code    int32
 	message string
 }
 
-// Code for this error
+// Code returns the HTTP status code for this composite error.
 func (c *CompositeError) Code() int32 {
 	return c.code
 }
 
+// Error implements the standard error interface.
 func (c *CompositeError) Error() string {
 	if len(c.Errors) > 0 {
 		msgs := []string{c.message + ":"}
 		for _, e := range c.Errors {
+			if e == nil {
+				continue
+			}
 			msgs = append(msgs, e.Error())
 		}
 		return strings.Join(msgs, "\n")
@@ -124,20 +119,21 @@ func (c *CompositeError) Error() string {
 	return c.message
 }
 
+// Unwrap implements the [errors.Unwrap] interface.
 func (c *CompositeError) Unwrap() []error {
 	return c.Errors
 }
 
-// MarshalJSON implements the JSON encoding interface
+// MarshalJSON implements the JSON encoding interface.
 func (c CompositeError) MarshalJSON() ([]byte, error) {
-	return json.Marshal(map[string]interface{}{
+	return json.Marshal(map[string]any{
 		"code":    c.code,
 		"message": c.message,
 		"errors":  c.Errors,
 	})
 }
 
-// CompositeValidationError an error to wrap a bunch of other errors
+// CompositeValidationError an error to wrap a bunch of other errors.
 func CompositeValidationError(errors ...error) *CompositeError {
 	return &CompositeError{
 		code:    CompositeErrorCode,
@@ -146,20 +142,33 @@ func CompositeValidationError(errors ...error) *CompositeError {
 	}
 }
 
-// ValidateName recursively sets the name for all validations or updates them for nested properties
+// ValidateName recursively sets the name for all validations or updates them for nested properties.
 func (c *CompositeError) ValidateName(name string) *CompositeError {
 	for i, e := range c.Errors {
-		if ve, ok := e.(*Validation); ok {
-			c.Errors[i] = ve.ValidateName(name)
-		} else if ce, ok := e.(*CompositeError); ok {
-			c.Errors[i] = ce.ValidateName(name)
+		if e == nil {
+			continue
 		}
+
+		ce := &CompositeError{}
+		if errors.As(e, &ce) {
+			c.Errors[i] = ce.ValidateName(name)
+
+			continue
+		}
+
+		ve := &Validation{}
+		if errors.As(e, &ve) {
+			c.Errors[i] = ve.ValidateName(name)
+
+			continue
+		}
+
 	}
 
 	return c
 }
 
-// FailedAllPatternProperties an error for when the property doesn't match a pattern
+// FailedAllPatternProperties an error for when the property doesn't match a pattern.
 func FailedAllPatternProperties(name, in, key string) *Validation {
 	msg := fmt.Sprintf(failedAllPatternProps, name, key, in)
 	if in == "" {
@@ -174,7 +183,7 @@ func FailedAllPatternProperties(name, in, key string) *Validation {
 	}
 }
 
-// PropertyNotAllowed an error for when the property doesn't match a pattern
+// PropertyNotAllowed an error for when the property doesn't match a pattern.
 func PropertyNotAllowed(name, in, key string) *Validation {
 	msg := fmt.Sprintf(unallowedProperty, name, key, in)
 	if in == "" {
@@ -189,7 +198,7 @@ func PropertyNotAllowed(name, in, key string) *Validation {
 	}
 }
 
-// TooFewProperties an error for an object with too few properties
+// TooFewProperties an error for an object with too few properties.
 func TooFewProperties(name, in string, n int64) *Validation {
 	msg := fmt.Sprintf(tooFewProperties, name, in, n)
 	if in == "" {
@@ -204,7 +213,7 @@ func TooFewProperties(name, in string, n int64) *Validation {
 	}
 }
 
-// TooManyProperties an error for an object with too many properties
+// TooManyProperties an error for an object with too many properties.
 func TooManyProperties(name, in string, n int64) *Validation {
 	msg := fmt.Sprintf(tooManyProperties, name, in, n)
 	if in == "" {
@@ -219,7 +228,7 @@ func TooManyProperties(name, in string, n int64) *Validation {
 	}
 }
 
-// AdditionalItemsNotAllowed an error for invalid additional items
+// AdditionalItemsNotAllowed an error for invalid additional items.
 func AdditionalItemsNotAllowed(name, in string) *Validation {
 	msg := fmt.Sprintf(noAdditionalItems, name, in)
 	if in == "" {
@@ -233,7 +242,7 @@ func AdditionalItemsNotAllowed(name, in string) *Validation {
 	}
 }
 
-// InvalidCollectionFormat another flavor of invalid type error
+// InvalidCollectionFormat another flavor of invalid type error.
 func InvalidCollectionFormat(name, in, format string) *Validation {
 	return &Validation{
 		code:    InvalidTypeCode,
@@ -244,7 +253,7 @@ func InvalidCollectionFormat(name, in, format string) *Validation {
 	}
 }
 
-// InvalidTypeName an error for when the type is invalid
+// InvalidTypeName an error for when the type is invalid.
 func InvalidTypeName(typeName string) *Validation {
 	return &Validation{
 		code:    InvalidTypeCode,
@@ -253,8 +262,8 @@ func InvalidTypeName(typeName string) *Validation {
 	}
 }
 
-// InvalidType creates an error for when the type is invalid
-func InvalidType(name, in, typeName string, value interface{}) *Validation {
+// InvalidType creates an error for when the type is invalid.
+func InvalidType(name, in, typeName string, value any) *Validation {
 	var message string
 
 	if in != "" {
@@ -284,10 +293,9 @@ func InvalidType(name, in, typeName string, value interface{}) *Validation {
 		Value:   value,
 		message: message,
 	}
-
 }
 
-// DuplicateItems error for when an array contains duplicates
+// DuplicateItems error for when an array contains duplicates.
 func DuplicateItems(name, in string) *Validation {
 	msg := fmt.Sprintf(uniqueFail, name, in)
 	if in == "" {
@@ -301,8 +309,8 @@ func DuplicateItems(name, in string) *Validation {
 	}
 }
 
-// TooManyItems error for when an array contains too many items
-func TooManyItems(name, in string, maximum int64, value interface{}) *Validation {
+// TooManyItems error for when an array contains too many items.
+func TooManyItems(name, in string, maximum int64, value any) *Validation {
 	msg := fmt.Sprintf(maximumItemsFail, name, in, maximum)
 	if in == "" {
 		msg = fmt.Sprintf(maximumItemsFailNoIn, name, maximum)
@@ -317,8 +325,8 @@ func TooManyItems(name, in string, maximum int64, value interface{}) *Validation
 	}
 }
 
-// TooFewItems error for when an array contains too few items
-func TooFewItems(name, in string, minimum int64, value interface{}) *Validation {
+// TooFewItems error for when an array contains too few items.
+func TooFewItems(name, in string, minimum int64, value any) *Validation {
 	msg := fmt.Sprintf(minItemsFail, name, in, minimum)
 	if in == "" {
 		msg = fmt.Sprintf(minItemsFailNoIn, name, minimum)
@@ -332,8 +340,8 @@ func TooFewItems(name, in string, minimum int64, value interface{}) *Validation
 	}
 }
 
-// ExceedsMaximumInt error for when maximumimum validation fails
-func ExceedsMaximumInt(name, in string, maximum int64, exclusive bool, value interface{}) *Validation {
+// ExceedsMaximumInt error for when maximum validation fails.
+func ExceedsMaximumInt(name, in string, maximum int64, exclusive bool, value any) *Validation {
 	var message string
 	if in == "" {
 		m := maximumIncFailNoIn
@@ -357,8 +365,8 @@ func ExceedsMaximumInt(name, in string, maximum int64, exclusive bool, value int
 	}
 }
 
-// ExceedsMaximumUint error for when maximumimum validation fails
-func ExceedsMaximumUint(name, in string, maximum uint64, exclusive bool, value interface{}) *Validation {
+// ExceedsMaximumUint error for when maximum validation fails.
+func ExceedsMaximumUint(name, in string, maximum uint64, exclusive bool, value any) *Validation {
 	var message string
 	if in == "" {
 		m := maximumIncFailNoIn
@@ -382,8 +390,8 @@ func ExceedsMaximumUint(name, in string, maximum uint64, exclusive bool, value i
 	}
 }
 
-// ExceedsMaximum error for when maximumimum validation fails
-func ExceedsMaximum(name, in string, maximum float64, exclusive bool, value interface{}) *Validation {
+// ExceedsMaximum error for when maximum validation fails.
+func ExceedsMaximum(name, in string, maximum float64, exclusive bool, value any) *Validation {
 	var message string
 	if in == "" {
 		m := maximumIncFailNoIn
@@ -407,8 +415,8 @@ func ExceedsMaximum(name, in string, maximum float64, exclusive bool, value inte
 	}
 }
 
-// ExceedsMinimumInt error for when minimum validation fails
-func ExceedsMinimumInt(name, in string, minimum int64, exclusive bool, value interface{}) *Validation {
+// ExceedsMinimumInt error for when minimum validation fails.
+func ExceedsMinimumInt(name, in string, minimum int64, exclusive bool, value any) *Validation {
 	var message string
 	if in == "" {
 		m := minIncFailNoIn
@@ -432,8 +440,8 @@ func ExceedsMinimumInt(name, in string, minimum int64, exclusive bool, value int
 	}
 }
 
-// ExceedsMinimumUint error for when minimum validation fails
-func ExceedsMinimumUint(name, in string, minimum uint64, exclusive bool, value interface{}) *Validation {
+// ExceedsMinimumUint error for when minimum validation fails.
+func ExceedsMinimumUint(name, in string, minimum uint64, exclusive bool, value any) *Validation {
 	var message string
 	if in == "" {
 		m := minIncFailNoIn
@@ -457,8 +465,8 @@ func ExceedsMinimumUint(name, in string, minimum uint64, exclusive bool, value i
 	}
 }
 
-// ExceedsMinimum error for when minimum validation fails
-func ExceedsMinimum(name, in string, minimum float64, exclusive bool, value interface{}) *Validation {
+// ExceedsMinimum error for when minimum validation fails.
+func ExceedsMinimum(name, in string, minimum float64, exclusive bool, value any) *Validation {
 	var message string
 	if in == "" {
 		m := minIncFailNoIn
@@ -482,8 +490,8 @@ func ExceedsMinimum(name, in string, minimum float64, exclusive bool, value inte
 	}
 }
 
-// NotMultipleOf error for when multiple of validation fails
-func NotMultipleOf(name, in string, multiple, value interface{}) *Validation {
+// NotMultipleOf error for when multiple of validation fails.
+func NotMultipleOf(name, in string, multiple, value any) *Validation {
 	var msg string
 	if in == "" {
 		msg = fmt.Sprintf(multipleOfFailNoIn, name, multiple)
@@ -499,8 +507,8 @@ func NotMultipleOf(name, in string, multiple, value interface{}) *Validation {
 	}
 }
 
-// EnumFail error for when an enum validation fails
-func EnumFail(name, in string, value interface{}, values []interface{}) *Validation {
+// EnumFail error for when an enum validation fails.
+func EnumFail(name, in string, value any, values []any) *Validation {
 	var msg string
 	if in == "" {
 		msg = fmt.Sprintf(enumFailNoIn, name, values)
@@ -518,8 +526,8 @@ func EnumFail(name, in string, value interface{}, values []interface{}) *Validat
 	}
 }
 
-// Required error for when a value is missing
-func Required(name, in string, value interface{}) *Validation {
+// Required error for when a value is missing.
+func Required(name, in string, value any) *Validation {
 	var msg string
 	if in == "" {
 		msg = fmt.Sprintf(requiredFailNoIn, name)
@@ -535,8 +543,8 @@ func Required(name, in string, value interface{}) *Validation {
 	}
 }
 
-// ReadOnly error for when a value is present in request
-func ReadOnly(name, in string, value interface{}) *Validation {
+// ReadOnly error for when a value is present in request.
+func ReadOnly(name, in string, value any) *Validation {
 	var msg string
 	if in == "" {
 		msg = fmt.Sprintf(readOnlyFailNoIn, name)
@@ -552,8 +560,8 @@ func ReadOnly(name, in string, value interface{}) *Validation {
 	}
 }
 
-// TooLong error for when a string is too long
-func TooLong(name, in string, maximum int64, value interface{}) *Validation {
+// TooLong error for when a string is too long.
+func TooLong(name, in string, maximum int64, value any) *Validation {
 	var msg string
 	if in == "" {
 		msg = fmt.Sprintf(tooLongMessageNoIn, name, maximum)
@@ -569,8 +577,8 @@ func TooLong(name, in string, maximum int64, value interface{}) *Validation {
 	}
 }
 
-// TooShort error for when a string is too short
-func TooShort(name, in string, minimum int64, value interface{}) *Validation {
+// TooShort error for when a string is too short.
+func TooShort(name, in string, minimum int64, value any) *Validation {
 	var msg string
 	if in == "" {
 		msg = fmt.Sprintf(tooShortMessageNoIn, name, minimum)
@@ -589,7 +597,7 @@ func TooShort(name, in string, minimum int64, value interface{}) *Validation {
 
 // FailedPattern error for when a string fails a regex pattern match
 // the pattern that is returned is the ECMA syntax version of the pattern not the golang version.
-func FailedPattern(name, in, pattern string, value interface{}) *Validation {
+func FailedPattern(name, in, pattern string, value any) *Validation {
 	var msg string
 	if in == "" {
 		msg = fmt.Sprintf(patternFailNoIn, name, pattern)
@@ -607,8 +615,8 @@ func FailedPattern(name, in, pattern string, value interface{}) *Validation {
 }
 
 // MultipleOfMustBePositive error for when a
-// multipleOf factor is negative
-func MultipleOfMustBePositive(name, in string, factor interface{}) *Validation {
+// multipleOf factor is negative.
+func MultipleOfMustBePositive(name, in string, factor any) *Validation {
 	return &Validation{
 		code:    MultipleOfMustBePositiveCode,
 		Name:    name,

src/runtime/vendor/gitlab.com/nvidia/cloud-native/go-nvlib/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

src/runtime/vendor/gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/bytes/bytes.go

@@ -0,0 +1,94 @@
+/*
+ * Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package bytes
+
+import (
+	"encoding/binary"
+	"unsafe"
+)
+
+// Raw returns just the bytes without any assumptions about layout
+type Raw interface {
+	Raw() *[]byte
+}
+
+// Reader used to read various data sizes in the byte array
+type Reader interface {
+	Read8(pos int) uint8
+	Read16(pos int) uint16
+	Read32(pos int) uint32
+	Read64(pos int) uint64
+	Len() int
+}
+
+// Writer used to write various sizes of data in the byte array
+type Writer interface {
+	Write8(pos int, value uint8)
+	Write16(pos int, value uint16)
+	Write32(pos int, value uint32)
+	Write64(pos int, value uint64)
+	Len() int
+}
+
+// Bytes object for manipulating arbitrary byte arrays
+type Bytes interface {
+	Raw
+	Reader
+	Writer
+	Slice(offset int, size int) Bytes
+	LittleEndian() Bytes
+	BigEndian() Bytes
+}
+
+var nativeByteOrder binary.ByteOrder
+
+func init() {
+	buf := [2]byte{}
+	*(*uint16)(unsafe.Pointer(&buf[0])) = uint16(0x00FF)
+
+	switch buf {
+	case [2]byte{0xFF, 0x00}:
+		nativeByteOrder = binary.LittleEndian
+	case [2]byte{0x00, 0xFF}:
+		nativeByteOrder = binary.BigEndian
+	default:
+		panic("Unable to infer byte order")
+	}
+}
+
+// New raw bytearray
+func New(data *[]byte) Bytes {
+	return (*native)(data)
+}
+
+// NewLittleEndian little endian ordering of bytes
+func NewLittleEndian(data *[]byte) Bytes {
+	if nativeByteOrder == binary.LittleEndian {
+		return (*native)(data)
+	}
+
+	return (*swapbo)(data)
+}
+
+// NewBigEndian big endian ordering of bytes
+func NewBigEndian(data *[]byte) Bytes {
+	if nativeByteOrder == binary.BigEndian {
+		return (*native)(data)
+	}
+
+	return (*swapbo)(data)
+}

src/runtime/vendor/gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/bytes/native.go

@@ -0,0 +1,78 @@
+/*
+ * Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package bytes
+
+import (
+	"unsafe"
+)
+
+type native []byte
+
+var _ Bytes = (*native)(nil)
+
+func (b *native) Read8(pos int) uint8 {
+	return (*b)[pos]
+}
+
+func (b *native) Read16(pos int) uint16 {
+	return *(*uint16)(unsafe.Pointer(&((*b)[pos])))
+}
+
+func (b *native) Read32(pos int) uint32 {
+	return *(*uint32)(unsafe.Pointer(&((*b)[pos])))
+}
+
+func (b *native) Read64(pos int) uint64 {
+	return *(*uint64)(unsafe.Pointer(&((*b)[pos])))
+}
+
+func (b *native) Write8(pos int, value uint8) {
+	(*b)[pos] = value
+}
+
+func (b *native) Write16(pos int, value uint16) {
+	*(*uint16)(unsafe.Pointer(&((*b)[pos]))) = value
+}
+
+func (b *native) Write32(pos int, value uint32) {
+	*(*uint32)(unsafe.Pointer(&((*b)[pos]))) = value
+}
+
+func (b *native) Write64(pos int, value uint64) {
+	*(*uint64)(unsafe.Pointer(&((*b)[pos]))) = value
+}
+
+func (b *native) Slice(offset int, size int) Bytes {
+	nb := (*b)[offset : offset+size]
+	return &nb
+}
+
+func (b *native) LittleEndian() Bytes {
+	return NewLittleEndian((*[]byte)(b))
+}
+
+func (b *native) BigEndian() Bytes {
+	return NewBigEndian((*[]byte)(b))
+}
+
+func (b *native) Raw() *[]byte {
+	return (*[]byte)(b)
+}
+
+func (b *native) Len() int {
+	return len(*b)
+}

src/runtime/vendor/gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/bytes/swapbo.go

@@ -0,0 +1,112 @@
+/*
+ * Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package bytes
+
+import (
+	"unsafe"
+)
+
+type swapbo []byte
+
+var _ Bytes = (*swapbo)(nil)
+
+func (b *swapbo) Read8(pos int) uint8 {
+	return (*b)[pos]
+}
+
+func (b *swapbo) Read16(pos int) uint16 {
+	buf := [2]byte{}
+	buf[0] = (*b)[pos+1]
+	buf[1] = (*b)[pos+0]
+	return *(*uint16)(unsafe.Pointer(&buf[0]))
+}
+
+func (b *swapbo) Read32(pos int) uint32 {
+	buf := [4]byte{}
+	buf[0] = (*b)[pos+3]
+	buf[1] = (*b)[pos+2]
+	buf[2] = (*b)[pos+1]
+	buf[3] = (*b)[pos+0]
+	return *(*uint32)(unsafe.Pointer(&buf[0]))
+}
+
+func (b *swapbo) Read64(pos int) uint64 {
+	buf := [8]byte{}
+	buf[0] = (*b)[pos+7]
+	buf[1] = (*b)[pos+6]
+	buf[2] = (*b)[pos+5]
+	buf[3] = (*b)[pos+4]
+	buf[4] = (*b)[pos+3]
+	buf[5] = (*b)[pos+2]
+	buf[6] = (*b)[pos+1]
+	buf[7] = (*b)[pos+0]
+	return *(*uint64)(unsafe.Pointer(&buf[0]))
+}
+
+func (b *swapbo) Write8(pos int, value uint8) {
+	(*b)[pos] = value
+}
+
+func (b *swapbo) Write16(pos int, value uint16) {
+	buf := [2]byte{}
+	*(*uint16)(unsafe.Pointer(&buf[0])) = value
+	(*b)[pos+0] = buf[1]
+	(*b)[pos+1] = buf[0]
+}
+
+func (b *swapbo) Write32(pos int, value uint32) {
+	buf := [4]byte{}
+	*(*uint32)(unsafe.Pointer(&buf[0])) = value
+	(*b)[pos+0] = buf[3]
+	(*b)[pos+1] = buf[2]
+	(*b)[pos+2] = buf[1]
+	(*b)[pos+3] = buf[0]
+}
+
+func (b *swapbo) Write64(pos int, value uint64) {
+	buf := [8]byte{}
+	*(*uint64)(unsafe.Pointer(&buf[0])) = value
+	(*b)[pos+0] = buf[7]
+	(*b)[pos+1] = buf[6]
+	(*b)[pos+2] = buf[5]
+	(*b)[pos+3] = buf[4]
+	(*b)[pos+4] = buf[3]
+	(*b)[pos+5] = buf[2]
+	(*b)[pos+6] = buf[1]
+	(*b)[pos+7] = buf[0]
+}
+
+func (b *swapbo) Slice(offset int, size int) Bytes {
+	nb := (*b)[offset : offset+size]
+	return &nb
+}
+
+func (b *swapbo) LittleEndian() Bytes {
+	return NewLittleEndian((*[]byte)(b))
+}
+
+func (b *swapbo) BigEndian() Bytes {
+	return NewBigEndian((*[]byte)(b))
+}
+
+func (b *swapbo) Raw() *[]byte {
+	return (*[]byte)(b)
+}
+
+func (b *swapbo) Len() int {
+	return len(*b)
+}

src/runtime/vendor/gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/config.go

@@ -0,0 +1,143 @@
+/*
+ * Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package nvpci
+
+import (
+	"fmt"
+	"io/ioutil"
+
+	"gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/bytes"
+)
+
+const (
+	// PCICfgSpaceStandardSize represents the size in bytes of the standard config space
+	PCICfgSpaceStandardSize = 256
+	// PCICfgSpaceExtendedSize represents the size in bytes of the extended config space
+	PCICfgSpaceExtendedSize = 4096
+	// PCICapabilityListPointer represents offset for the capability list pointer
+	PCICapabilityListPointer = 0x34
+	// PCIStatusCapabilityList represents the status register bit which indicates capability list support
+	PCIStatusCapabilityList = 0x10
+	// PCIStatusBytePosition represents the position of the status register
+	PCIStatusBytePosition = 0x06
+)
+
+// ConfigSpace PCI configuration space (standard extended) file path
+type ConfigSpace struct {
+	Path string
+}
+
+// ConfigSpaceIO Interface for reading and writing raw and preconfigured values
+type ConfigSpaceIO interface {
+	bytes.Bytes
+	GetVendorID() uint16
+	GetDeviceID() uint16
+	GetPCICapabilities() (*PCICapabilities, error)
+}
+
+type configSpaceIO struct {
+	bytes.Bytes
+}
+
+// PCIStandardCapability standard PCI config space
+type PCIStandardCapability struct {
+	bytes.Bytes
+}
+
+// PCIExtendedCapability extended PCI config space
+type PCIExtendedCapability struct {
+	bytes.Bytes
+	Version uint8
+}
+
+// PCICapabilities combines the standard and extended config space
+type PCICapabilities struct {
+	Standard map[uint8]*PCIStandardCapability
+	Extended map[uint16]*PCIExtendedCapability
+}
+
+func (cs *ConfigSpace) Read() (ConfigSpaceIO, error) {
+	config, err := ioutil.ReadFile(cs.Path)
+	if err != nil {
+		return nil, fmt.Errorf("failed to open file: %v", err)
+	}
+	return &configSpaceIO{bytes.New(&config)}, nil
+}
+
+func (cs *configSpaceIO) GetVendorID() uint16 {
+	return cs.Read16(0)
+}
+
+func (cs *configSpaceIO) GetDeviceID() uint16 {
+	return cs.Read16(2)
+}
+
+func (cs *configSpaceIO) GetPCICapabilities() (*PCICapabilities, error) {
+	caps := &PCICapabilities{
+		make(map[uint8]*PCIStandardCapability),
+		make(map[uint16]*PCIExtendedCapability),
+	}
+
+	support := cs.Read8(PCIStatusBytePosition) & PCIStatusCapabilityList
+	if support == 0 {
+		return nil, fmt.Errorf("pci device does not support capability list")
+	}
+
+	soffset := cs.Read8(PCICapabilityListPointer)
+	if int(soffset) >= cs.Len() {
+		return nil, fmt.Errorf("capability list pointer out of bounds")
+	}
+
+	for soffset != 0 {
+		if soffset == 0xff {
+			return nil, fmt.Errorf("config space broken")
+		}
+		if int(soffset) >= PCICfgSpaceStandardSize {
+			return nil, fmt.Errorf("standard capability list pointer out of bounds")
+		}
+		data := cs.Read32(int(soffset))
+		id := uint8(data & 0xff)
+		caps.Standard[id] = &PCIStandardCapability{
+			cs.Slice(int(soffset), cs.Len()-int(soffset)),
+		}
+		soffset = uint8((data >> 8) & 0xff)
+	}
+
+	if cs.Len() <= PCICfgSpaceStandardSize {
+		return caps, nil
+	}
+
+	eoffset := uint16(PCICfgSpaceStandardSize)
+	for eoffset != 0 {
+		if eoffset == 0xffff {
+			return nil, fmt.Errorf("config space broken")
+		}
+		if int(eoffset) >= PCICfgSpaceExtendedSize {
+			return nil, fmt.Errorf("extended capability list pointer out of bounds")
+		}
+		data := cs.Read32(int(eoffset))
+		id := uint16(data & 0xffff)
+		version := uint8((data >> 16) & 0xf)
+		caps.Extended[id] = &PCIExtendedCapability{
+			cs.Slice(int(eoffset), cs.Len()-int(eoffset)),
+			version,
+		}
+		eoffset = uint16((data >> 4) & 0xffc)
+	}
+
+	return caps, nil
+}

src/runtime/vendor/gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/mmio/mmio.go

@@ -0,0 +1,127 @@
+/*
+ * Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package mmio
+
+import (
+	"fmt"
+	"os"
+	"syscall"
+	"unsafe"
+
+	"gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/bytes"
+)
+
+// Mmio memory map a region
+type Mmio interface {
+	bytes.Raw
+	bytes.Reader
+	bytes.Writer
+	Sync() error
+	Close() error
+	Slice(offset int, size int) Mmio
+	LittleEndian() Mmio
+	BigEndian() Mmio
+}
+
+type mmio struct {
+	bytes.Bytes
+}
+
+func open(path string, offset int, size int, flags int) (Mmio, error) {
+	var mmapFlags int
+	switch flags {
+	case os.O_RDONLY:
+		mmapFlags = syscall.PROT_READ
+	case os.O_RDWR:
+		mmapFlags = syscall.PROT_READ | syscall.PROT_WRITE
+	default:
+		return nil, fmt.Errorf("invalid flags: %v", flags)
+	}
+
+	file, err := os.OpenFile(path, flags, 0)
+	if err != nil {
+		return nil, fmt.Errorf("failed to open file: %v", err)
+	}
+	defer file.Close()
+
+	fi, err := file.Stat()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get file info: %v", err)
+	}
+
+	if size > int(fi.Size()) {
+		return nil, fmt.Errorf("requested size larger than file size")
+	}
+
+	if size < 0 {
+		size = int(fi.Size())
+	}
+
+	mmap, err := syscall.Mmap(
+		int(file.Fd()),
+		int64(offset),
+		size,
+		mmapFlags,
+		syscall.MAP_SHARED)
+	if err != nil {
+		return nil, fmt.Errorf("failed to mmap file: %v", err)
+	}
+
+	return &mmio{bytes.New(&mmap)}, nil
+}
+
+// OpenRO open region readonly
+func OpenRO(path string, offset int, size int) (Mmio, error) {
+	return open(path, offset, size, os.O_RDONLY)
+}
+
+// OpenRW open region read write
+func OpenRW(path string, offset int, size int) (Mmio, error) {
+	return open(path, offset, size, os.O_RDWR)
+}
+
+func (m *mmio) Slice(offset int, size int) Mmio {
+	return &mmio{m.Bytes.Slice(offset, size)}
+}
+
+func (m *mmio) LittleEndian() Mmio {
+	return &mmio{m.Bytes.LittleEndian()}
+}
+
+func (m *mmio) BigEndian() Mmio {
+	return &mmio{m.Bytes.BigEndian()}
+}
+
+func (m *mmio) Close() error {
+	err := syscall.Munmap(*m.Bytes.Raw())
+	if err != nil {
+		return fmt.Errorf("failed to munmap file: %v", err)
+	}
+	return nil
+}
+
+func (m *mmio) Sync() error {
+	_, _, errno := syscall.Syscall(
+		syscall.SYS_MSYNC,
+		uintptr(unsafe.Pointer(&(*m.Bytes.Raw())[0])),
+		uintptr(m.Len()),
+		uintptr(syscall.MS_SYNC|syscall.MS_INVALIDATE))
+	if errno != 0 {
+		return fmt.Errorf("failed to msync file: %v", errno)
+	}
+	return nil
+}

src/runtime/vendor/gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/mmio/mock.go

@@ -0,0 +1,74 @@
+/*
+ * Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package mmio
+
+import (
+	"fmt"
+
+	"gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/bytes"
+)
+
+type mockMmio struct {
+	mmio
+	source *[]byte
+	offset int
+	rw     bool
+}
+
+func mockOpen(source *[]byte, offset int, size int, rw bool) (Mmio, error) {
+	if size < 0 {
+		size = len(*source) - offset
+	}
+	if (offset + size) > len(*source) {
+		return nil, fmt.Errorf("offset+size out of range")
+	}
+
+	data := append([]byte{}, (*source)[offset:offset+size]...)
+
+	m := &mockMmio{}
+	m.Bytes = bytes.New(&data).LittleEndian()
+	m.source = source
+	m.offset = offset
+	m.rw = rw
+
+	return m, nil
+}
+
+// MockOpenRO open read only
+func MockOpenRO(source *[]byte, offset int, size int) (Mmio, error) {
+	return mockOpen(source, offset, size, false)
+}
+
+// MockOpenRW open read write
+func MockOpenRW(source *[]byte, offset int, size int) (Mmio, error) {
+	return mockOpen(source, offset, size, true)
+}
+
+func (m *mockMmio) Close() error {
+	m = &mockMmio{}
+	return nil
+}
+
+func (m *mockMmio) Sync() error {
+	if !m.rw {
+		return fmt.Errorf("opened read-only")
+	}
+	for i := range *m.Bytes.Raw() {
+		(*m.source)[m.offset+i] = (*m.Bytes.Raw())[i]
+	}
+	return nil
+}

src/runtime/vendor/gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/mock.go

@@ -0,0 +1,141 @@
+/*
+ * Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package nvpci
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+
+	"gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/bytes"
+)
+
+// MockNvpci mock pci device
+type MockNvpci struct {
+	*nvpci
+}
+
+var _ Interface = (*MockNvpci)(nil)
+
+// NewMockNvpci create new mock PCI and remove old devices
+func NewMockNvpci() (mock *MockNvpci, rerr error) {
+	rootDir, err := ioutil.TempDir("", "")
+	if err != nil {
+		return nil, err
+	}
+	defer func() {
+		if rerr != nil {
+			os.RemoveAll(rootDir)
+		}
+	}()
+
+	mock = &MockNvpci{
+		NewFrom(rootDir).(*nvpci),
+	}
+
+	return mock, nil
+}
+
+// Cleanup remove the mocked PCI devices root folder
+func (m *MockNvpci) Cleanup() {
+	os.RemoveAll(m.pciDevicesRoot)
+}
+
+// AddMockA100 Create an A100 like GPU mock device
+func (m *MockNvpci) AddMockA100(address string, numaNode int) error {
+	deviceDir := filepath.Join(m.pciDevicesRoot, address)
+	err := os.MkdirAll(deviceDir, 0755)
+	if err != nil {
+		return err
+	}
+
+	vendor, err := os.Create(filepath.Join(deviceDir, "vendor"))
+	if err != nil {
+		return err
+	}
+	_, err = vendor.WriteString(fmt.Sprintf("0x%x", PCINvidiaVendorID))
+	if err != nil {
+		return err
+	}
+
+	class, err := os.Create(filepath.Join(deviceDir, "class"))
+	if err != nil {
+		return err
+	}
+	_, err = class.WriteString(fmt.Sprintf("0x%x", PCI3dControllerClass))
+	if err != nil {
+		return err
+	}
+
+	device, err := os.Create(filepath.Join(deviceDir, "device"))
+	if err != nil {
+		return err
+	}
+	_, err = device.WriteString("0x20bf")
+	if err != nil {
+		return err
+	}
+
+	numa, err := os.Create(filepath.Join(deviceDir, "numa_node"))
+	if err != nil {
+		return err
+	}
+	_, err = numa.WriteString(fmt.Sprintf("%v", numaNode))
+	if err != nil {
+		return err
+	}
+
+	config, err := os.Create(filepath.Join(deviceDir, "config"))
+	if err != nil {
+		return err
+	}
+	_data := make([]byte, PCICfgSpaceStandardSize)
+	data := bytes.New(&_data)
+	data.Write16(0, PCINvidiaVendorID)
+	data.Write16(2, uint16(0x20bf))
+	data.Write8(PCIStatusBytePosition, PCIStatusCapabilityList)
+	_, err = config.Write(*data.Raw())
+	if err != nil {
+		return err
+	}
+
+	bar0 := []uint64{0x00000000c2000000, 0x00000000c2ffffff, 0x0000000000040200}
+	resource, err := os.Create(filepath.Join(deviceDir, "resource"))
+	if err != nil {
+		return err
+	}
+	_, err = resource.WriteString(fmt.Sprintf("0x%x 0x%x 0x%x", bar0[0], bar0[1], bar0[2]))
+	if err != nil {
+		return err
+	}
+
+	pmcID := uint32(0x170000a1)
+	resource0, err := os.Create(filepath.Join(deviceDir, "resource0"))
+	if err != nil {
+		return err
+	}
+	_data = make([]byte, bar0[1]-bar0[0]+1)
+	data = bytes.New(&_data).LittleEndian()
+	data.Write32(0, pmcID)
+	_, err = resource0.Write(*data.Raw())
+	if err != nil {
+		return err
+	}
+
+	return nil
+}

src/runtime/vendor/gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/nvpci.go

@@ -0,0 +1,316 @@
+/*
+ * Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package nvpci
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path"
+	"sort"
+	"strconv"
+	"strings"
+)
+
+const (
+	// PCIDevicesRoot represents base path for all pci devices under sysfs
+	PCIDevicesRoot = "/sys/bus/pci/devices"
+	// PCINvidiaVendorID represents PCI vendor id for NVIDIA
+	PCINvidiaVendorID uint16 = 0x10de
+	// PCIVgaControllerClass represents the PCI class for VGA Controllers
+	PCIVgaControllerClass uint32 = 0x030000
+	// PCI3dControllerClass represents the PCI class for 3D Graphics accellerators
+	PCI3dControllerClass uint32 = 0x030200
+	// PCINvSwitchClass represents the PCI class for NVSwitches
+	PCINvSwitchClass uint32 = 0x068000
+)
+
+// Interface allows us to get a list of all NVIDIA PCI devices
+type Interface interface {
+	GetAllDevices() ([]*NvidiaPCIDevice, error)
+	Get3DControllers() ([]*NvidiaPCIDevice, error)
+	GetVGAControllers() ([]*NvidiaPCIDevice, error)
+	GetNVSwitches() ([]*NvidiaPCIDevice, error)
+	GetGPUs() ([]*NvidiaPCIDevice, error)
+}
+
+// MemoryResources a more human readable handle
+type MemoryResources map[int]*MemoryResource
+
+// ResourceInterface exposes some higher level functions of resources
+type ResourceInterface interface {
+	GetTotalAddressableMemory(bool) (uint64, uint64)
+}
+
+type nvpci struct {
+	pciDevicesRoot string
+}
+
+var _ Interface = (*nvpci)(nil)
+var _ ResourceInterface = (*MemoryResources)(nil)
+
+// NvidiaPCIDevice represents a PCI device for an NVIDIA product
+type NvidiaPCIDevice struct {
+	Path      string
+	Address   string
+	Vendor    uint16
+	Class     uint32
+	Device    uint16
+	NumaNode  int
+	Config    *ConfigSpace
+	Resources MemoryResources
+}
+
+// IsVGAController if class == 0x300
+func (d *NvidiaPCIDevice) IsVGAController() bool {
+	return d.Class == PCIVgaControllerClass
+}
+
+// Is3DController if class == 0x302
+func (d *NvidiaPCIDevice) Is3DController() bool {
+	return d.Class == PCI3dControllerClass
+}
+
+// IsNVSwitch if classe == 0x068
+func (d *NvidiaPCIDevice) IsNVSwitch() bool {
+	return d.Class == PCINvSwitchClass
+}
+
+// IsGPU either VGA for older cards or 3D for newer
+func (d *NvidiaPCIDevice) IsGPU() bool {
+	return d.IsVGAController() || d.Is3DController()
+}
+
+// IsResetAvailable some devices can be reset without rebooting,
+// check if applicable
+func (d *NvidiaPCIDevice) IsResetAvailable() bool {
+	_, err := os.Stat(path.Join(d.Path, "reset"))
+	return err == nil
+}
+
+// Reset perform a reset to apply a new configuration at HW level
+func (d *NvidiaPCIDevice) Reset() error {
+	err := ioutil.WriteFile(path.Join(d.Path, "reset"), []byte("1"), 0)
+	if err != nil {
+		return fmt.Errorf("unable to write to reset file: %v", err)
+	}
+	return nil
+}
+
+// New interface that allows us to get a list of all NVIDIA PCI devices
+func New() Interface {
+	return &nvpci{PCIDevicesRoot}
+}
+
+// NewFrom interface allows us to get a list of all NVIDIA PCI devices at a specific root directory
+func NewFrom(root string) Interface {
+	return &nvpci{root}
+}
+
+// GetAllDevices returns all Nvidia PCI devices on the system
+func (p *nvpci) GetAllDevices() ([]*NvidiaPCIDevice, error) {
+	deviceDirs, err := ioutil.ReadDir(p.pciDevicesRoot)
+	if err != nil {
+		return nil, fmt.Errorf("unable to read PCI bus devices: %v", err)
+	}
+
+	var nvdevices []*NvidiaPCIDevice
+	for _, deviceDir := range deviceDirs {
+		devicePath := path.Join(p.pciDevicesRoot, deviceDir.Name())
+		nvdevice, err := NewDevice(devicePath)
+		if err != nil {
+			return nil, fmt.Errorf("error constructing NVIDIA PCI device %s: %v", deviceDir.Name(), err)
+		}
+		if nvdevice == nil {
+			continue
+		}
+		nvdevices = append(nvdevices, nvdevice)
+	}
+
+	addressToID := func(address string) uint64 {
+		address = strings.ReplaceAll(address, ":", "")
+		address = strings.ReplaceAll(address, ".", "")
+		id, _ := strconv.ParseUint(address, 16, 64)
+		return id
+	}
+
+	sort.Slice(nvdevices, func(i, j int) bool {
+		return addressToID(nvdevices[i].Address) < addressToID(nvdevices[j].Address)
+	})
+
+	return nvdevices, nil
+}
+
+// NewDevice constructs an NvidiaPCIDevice
+func NewDevice(devicePath string) (*NvidiaPCIDevice, error) {
+	address := path.Base(devicePath)
+
+	vendor, err := ioutil.ReadFile(path.Join(devicePath, "vendor"))
+	if err != nil {
+		return nil, fmt.Errorf("unable to read PCI device vendor id for %s: %v", address, err)
+	}
+	vendorStr := strings.TrimSpace(string(vendor))
+	vendorID, err := strconv.ParseUint(vendorStr, 0, 16)
+	if err != nil {
+		return nil, fmt.Errorf("unable to convert vendor string to uint16: %v", vendorStr)
+	}
+
+	if uint16(vendorID) != PCINvidiaVendorID {
+		return nil, nil
+	}
+
+	class, err := ioutil.ReadFile(path.Join(devicePath, "class"))
+	if err != nil {
+		return nil, fmt.Errorf("unable to read PCI device class for %s: %v", address, err)
+	}
+	classStr := strings.TrimSpace(string(class))
+	classID, err := strconv.ParseUint(classStr, 0, 32)
+	if err != nil {
+		return nil, fmt.Errorf("unable to convert class string to uint32: %v", classStr)
+	}
+
+	device, err := ioutil.ReadFile(path.Join(devicePath, "device"))
+	if err != nil {
+		return nil, fmt.Errorf("unable to read PCI device id for %s: %v", address, err)
+	}
+	deviceStr := strings.TrimSpace(string(device))
+	deviceID, err := strconv.ParseUint(deviceStr, 0, 16)
+	if err != nil {
+		return nil, fmt.Errorf("unable to convert device string to uint16: %v", deviceStr)
+	}
+
+	numa, err := ioutil.ReadFile(path.Join(devicePath, "numa_node"))
+	if err != nil {
+		return nil, fmt.Errorf("unable to read PCI NUMA node for %s: %v", address, err)
+	}
+	numaStr := strings.TrimSpace(string(numa))
+	numaNode, err := strconv.ParseInt(numaStr, 0, 64)
+	if err != nil {
+		return nil, fmt.Errorf("unable to convert NUMA node string to int64: %v", numaNode)
+	}
+
+	config := &ConfigSpace{
+		Path: path.Join(devicePath, "config"),
+	}
+
+	resource, err := ioutil.ReadFile(path.Join(devicePath, "resource"))
+	if err != nil {
+		return nil, fmt.Errorf("unable to read PCI resource file for %s: %v", address, err)
+	}
+
+	resources := make(map[int]*MemoryResource)
+	for i, line := range strings.Split(strings.TrimSpace(string(resource)), "\n") {
+		values := strings.Split(line, " ")
+		if len(values) != 3 {
+			return nil, fmt.Errorf("more than 3 entries in line '%d' of resource file", i)
+		}
+
+		start, _ := strconv.ParseUint(values[0], 0, 64)
+		end, _ := strconv.ParseUint(values[1], 0, 64)
+		flags, _ := strconv.ParseUint(values[2], 0, 64)
+
+		if (end - start) != 0 {
+			resources[i] = &MemoryResource{
+				uintptr(start),
+				uintptr(end),
+				flags,
+				fmt.Sprintf("%s/resource%d", devicePath, i),
+			}
+		}
+	}
+
+	nvdevice := &NvidiaPCIDevice{
+		Path:      devicePath,
+		Address:   address,
+		Vendor:    uint16(vendorID),
+		Class:     uint32(classID),
+		Device:    uint16(deviceID),
+		NumaNode:  int(numaNode),
+		Config:    config,
+		Resources: resources,
+	}
+
+	return nvdevice, nil
+}
+
+// Get3DControllers returns all NVIDIA 3D Controller PCI devices on the system
+func (p *nvpci) Get3DControllers() ([]*NvidiaPCIDevice, error) {
+	devices, err := p.GetAllDevices()
+	if err != nil {
+		return nil, fmt.Errorf("error getting all NVIDIA devices: %v", err)
+	}
+
+	var filtered []*NvidiaPCIDevice
+	for _, d := range devices {
+		if d.Is3DController() {
+			filtered = append(filtered, d)
+		}
+	}
+
+	return filtered, nil
+}
+
+// GetVGAControllers returns all NVIDIA VGA Controller PCI devices on the system
+func (p *nvpci) GetVGAControllers() ([]*NvidiaPCIDevice, error) {
+	devices, err := p.GetAllDevices()
+	if err != nil {
+		return nil, fmt.Errorf("error getting all NVIDIA devices: %v", err)
+	}
+
+	var filtered []*NvidiaPCIDevice
+	for _, d := range devices {
+		if d.IsVGAController() {
+			filtered = append(filtered, d)
+		}
+	}
+
+	return filtered, nil
+}
+
+// GetNVSwitches returns all NVIDIA NVSwitch PCI devices on the system
+func (p *nvpci) GetNVSwitches() ([]*NvidiaPCIDevice, error) {
+	devices, err := p.GetAllDevices()
+	if err != nil {
+		return nil, fmt.Errorf("error getting all NVIDIA devices: %v", err)
+	}
+
+	var filtered []*NvidiaPCIDevice
+	for _, d := range devices {
+		if d.IsNVSwitch() {
+			filtered = append(filtered, d)
+		}
+	}
+
+	return filtered, nil
+}
+
+// GetGPUs returns all NVIDIA GPU devices on the system
+func (p *nvpci) GetGPUs() ([]*NvidiaPCIDevice, error) {
+	devices, err := p.GetAllDevices()
+	if err != nil {
+		return nil, fmt.Errorf("error getting all NVIDIA devices: %v", err)
+	}
+
+	var filtered []*NvidiaPCIDevice
+	for _, d := range devices {
+		if d.IsGPU() {
+			filtered = append(filtered, d)
+		}
+	}
+
+	return filtered, nil
+}

src/runtime/vendor/gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/resources.go

@@ -0,0 +1,140 @@
+/*
+ * Copyright (c) 2021, NVIDIA CORPORATION.  All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package nvpci
+
+import (
+	"fmt"
+	"sort"
+
+	"gitlab.com/nvidia/cloud-native/go-nvlib/pkg/nvpci/mmio"
+)
+
+const (
+	pmcEndianRegister = 0x4
+	pmcLittleEndian   = 0x0
+	pmcBigEndian      = 0x01000001
+)
+
+// MemoryResource represents a mmio region
+type MemoryResource struct {
+	Start uintptr
+	End   uintptr
+	Flags uint64
+	Path  string
+}
+
+// OpenRW read write mmio region
+func (mr *MemoryResource) OpenRW() (mmio.Mmio, error) {
+	rw, err := mmio.OpenRW(mr.Path, 0, int(mr.End-mr.Start+1))
+	if err != nil {
+		return nil, fmt.Errorf("failed to open file for mmio: %v", err)
+	}
+	switch rw.Read32(pmcEndianRegister) {
+	case pmcBigEndian:
+		return rw.BigEndian(), nil
+	case pmcLittleEndian:
+		return rw.LittleEndian(), nil
+	}
+	return nil, fmt.Errorf("unknown endianness for mmio: %v", err)
+}
+
+// OpenRO read only mmio region
+func (mr *MemoryResource) OpenRO() (mmio.Mmio, error) {
+	ro, err := mmio.OpenRO(mr.Path, 0, int(mr.End-mr.Start+1))
+	if err != nil {
+		return nil, fmt.Errorf("failed to open file for mmio: %v", err)
+	}
+	switch ro.Read32(pmcEndianRegister) {
+	case pmcBigEndian:
+		return ro.BigEndian(), nil
+	case pmcLittleEndian:
+		return ro.LittleEndian(), nil
+	}
+	return nil, fmt.Errorf("unknown endianness for mmio: %v", err)
+}
+
+// From Bit Twiddling Hacks, great resource for all low level bit manipulations
+func calcNextPowerOf2(n uint64) uint64 {
+	n--
+	n |= n >> 1
+	n |= n >> 2
+	n |= n >> 4
+	n |= n >> 8
+	n |= n >> 16
+	n |= n >> 32
+	n++
+
+	return n
+}
+
+// GetTotalAddressableMemory will accumulate the 32bit and 64bit memory windows
+// of each BAR and round the value if needed to the next power of 2; first
+// return value is the accumulated 32bit addresable memory size the second one
+// is the accumulated 64bit addressable memory size in bytes. These values are
+// needed to configure virtualized environments.
+func (mrs MemoryResources) GetTotalAddressableMemory(roundUp bool) (uint64, uint64) {
+	const pciIOVNumBAR = 6
+	const pciBaseAddressMemTypeMask = 0x06
+	const pciBaseAddressMemType32 = 0x00 /* 32 bit address */
+	const pciBaseAddressMemType64 = 0x04 /* 64 bit address */
+
+	// We need to sort the resources so the first 6 entries are the BARs
+	// How a map is represented in memory is not guaranteed, it is not an
+	// array. Keys do not have an order.
+	keys := make([]int, 0, len(mrs))
+	for k := range mrs {
+		keys = append(keys, k)
+	}
+	sort.Ints(keys)
+
+	numBAR := 0
+	memSize32bit := uint64(0)
+	memSize64bit := uint64(0)
+
+	for _, key := range keys {
+		// The PCIe spec only defines 5 BARs per device, we're
+		// discarding everything after the 5th entry of the resources
+		// file, see lspci.c
+		if key >= pciIOVNumBAR || numBAR == pciIOVNumBAR {
+			break
+		}
+		numBAR = numBAR + 1
+
+		region := mrs[key]
+
+		flags := region.Flags & pciBaseAddressMemTypeMask
+		memType32bit := flags == pciBaseAddressMemType32
+		memType64bit := flags == pciBaseAddressMemType64
+
+		memSize := (region.End - region.Start) + 1
+
+		if memType32bit {
+			memSize32bit = memSize32bit + uint64(memSize)
+		}
+		if memType64bit {
+			memSize64bit = memSize64bit + uint64(memSize)
+		}
+
+	}
+
+	if roundUp {
+		memSize32bit = calcNextPowerOf2(memSize32bit)
+		memSize64bit = calcNextPowerOf2(memSize64bit)
+	}
+
+	return memSize32bit, memSize64bit
+}

src/runtime/vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/id.go

@@ -82,7 +82,7 @@ func marshalJSON(id []byte) ([]byte, error) {
 }
 
 // unmarshalJSON inflates trace id from hex string, possibly enclosed in quotes.
-func unmarshalJSON(dst, src []byte) error {
+func unmarshalJSON(dst []byte, src []byte) error {
 	if l := len(src); l >= 2 && src[0] == '"' && src[l-1] == '"' {
 		src = src[1 : l-1]
 	}

src/runtime/vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/number.go

@@ -41,7 +41,7 @@ func (i *protoInt64) UnmarshalJSON(data []byte) error {
 // strings or integers.
 type protoUint64 uint64
 
-// Uint64 returns the protoUint64 as a uint64.
+// Int64 returns the protoUint64 as a uint64.
 func (i *protoUint64) Uint64() uint64 { return uint64(*i) }
 
 // UnmarshalJSON decodes both strings and integers.

src/runtime/vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/span.go

@@ -10,7 +10,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"math"
 	"time"
 )
 
@@ -152,8 +151,8 @@ func (s Span) MarshalJSON() ([]byte, error) {
 	}{
 		Alias:        Alias(s),
 		ParentSpanID: parentSpanId,
-		StartTime:    uint64(startT), // nolint:gosec  // >0 checked above.
-		EndTime:      uint64(endT),   // nolint:gosec  // >0 checked above.
+		StartTime:    uint64(startT),
+		EndTime:      uint64(endT),
 	})
 }
 
@@ -202,13 +201,11 @@ func (s *Span) UnmarshalJSON(data []byte) error {
 		case "startTimeUnixNano", "start_time_unix_nano":
 			var val protoUint64
 			err = decoder.Decode(&val)
-			v := int64(min(val.Uint64(), math.MaxInt64)) //nolint:gosec  // Overflow checked.
-			s.StartTime = time.Unix(0, v)
+			s.StartTime = time.Unix(0, int64(val.Uint64()))
 		case "endTimeUnixNano", "end_time_unix_nano":
 			var val protoUint64
 			err = decoder.Decode(&val)
-			v := int64(min(val.Uint64(), math.MaxInt64)) //nolint:gosec  // Overflow checked.
-			s.EndTime = time.Unix(0, v)
+			s.EndTime = time.Unix(0, int64(val.Uint64()))
 		case "attributes":
 			err = decoder.Decode(&s.Attrs)
 		case "droppedAttributesCount", "dropped_attributes_count":
@@ -251,20 +248,13 @@ func (s *Span) UnmarshalJSON(data []byte) error {
 type SpanFlags int32
 
 const (
-	// SpanFlagsTraceFlagsMask is a mask for trace-flags.
-	//
 	// Bits 0-7 are used for trace flags.
 	SpanFlagsTraceFlagsMask SpanFlags = 255
-	// SpanFlagsContextHasIsRemoteMask is a mask for HAS_IS_REMOTE status.
-	//
-	// Bits 8 and 9 are used to indicate that the parent span or link span is
-	// remote. Bit 8 (`HAS_IS_REMOTE`) indicates whether the value is known.
+	// Bits 8 and 9 are used to indicate that the parent span or link span is remote.
+	// Bit 8 (`HAS_IS_REMOTE`) indicates whether the value is known.
+	// Bit 9 (`IS_REMOTE`) indicates whether the span or link is remote.
 	SpanFlagsContextHasIsRemoteMask SpanFlags = 256
-	// SpanFlagsContextIsRemoteMask is a mask for IS_REMOTE status.
-	//
-	// Bits 8 and 9 are used to indicate that the parent span or link span is
-	// remote. Bit 9 (`IS_REMOTE`) indicates whether the span or link is
-	// remote.
+	// SpanFlagsContextHasIsRemoteMask indicates the Span is remote.
 	SpanFlagsContextIsRemoteMask SpanFlags = 512
 )
 
@@ -273,30 +263,26 @@ const (
 type SpanKind int32
 
 const (
-	// SpanKindInternal indicates that the span represents an internal
-	// operation within an application, as opposed to an operation happening at
-	// the boundaries.
+	// Indicates that the span represents an internal operation within an application,
+	// as opposed to an operation happening at the boundaries. Default value.
 	SpanKindInternal SpanKind = 1
-	// SpanKindServer indicates that the span covers server-side handling of an
-	// RPC or other remote network request.
+	// Indicates that the span covers server-side handling of an RPC or other
+	// remote network request.
 	SpanKindServer SpanKind = 2
-	// SpanKindClient indicates that the span describes a request to some
-	// remote service.
+	// Indicates that the span describes a request to some remote service.
 	SpanKindClient SpanKind = 3
-	// SpanKindProducer indicates that the span describes a producer sending a
-	// message to a broker. Unlike SpanKindClient and SpanKindServer, there is
-	// often no direct critical path latency relationship between producer and
-	// consumer spans. A SpanKindProducer span ends when the message was
-	// accepted by the broker while the logical processing of the message might
-	// span a much longer time.
+	// Indicates that the span describes a producer sending a message to a broker.
+	// Unlike CLIENT and SERVER, there is often no direct critical path latency relationship
+	// between producer and consumer spans. A PRODUCER span ends when the message was accepted
+	// by the broker while the logical processing of the message might span a much longer time.
 	SpanKindProducer SpanKind = 4
-	// SpanKindConsumer indicates that the span describes a consumer receiving
-	// a message from a broker. Like SpanKindProducer, there is often no direct
-	// critical path latency relationship between producer and consumer spans.
+	// Indicates that the span describes consumer receiving a message from a broker.
+	// Like the PRODUCER kind, there is often no direct critical path latency relationship
+	// between producer and consumer spans.
 	SpanKindConsumer SpanKind = 5
 )
 
-// SpanEvent is a time-stamped annotation of the span, consisting of user-supplied
+// Event is a time-stamped annotation of the span, consisting of user-supplied
 // text description and key-value pairs.
 type SpanEvent struct {
 	// time_unix_nano is the time the event occurred.
@@ -326,7 +312,7 @@ func (e SpanEvent) MarshalJSON() ([]byte, error) {
 		Time uint64 `json:"timeUnixNano,omitempty"`
 	}{
 		Alias: Alias(e),
-		Time:  uint64(t), //nolint:gosec  // >0 checked above
+		Time:  uint64(t),
 	})
 }
 
@@ -361,8 +347,7 @@ func (se *SpanEvent) UnmarshalJSON(data []byte) error {
 		case "timeUnixNano", "time_unix_nano":
 			var val protoUint64
 			err = decoder.Decode(&val)
-			v := int64(min(val.Uint64(), math.MaxInt64)) //nolint:gosec  // Overflow checked.
-			se.Time = time.Unix(0, v)
+			se.Time = time.Unix(0, int64(val.Uint64()))
 		case "name":
 			err = decoder.Decode(&se.Name)
 		case "attributes":
@@ -380,11 +365,10 @@ func (se *SpanEvent) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-// SpanLink is a reference from the current span to another span in the same
-// trace or in a different trace. For example, this can be used in batching
-// operations, where a single batch handler processes multiple requests from
-// different traces or when the handler receives a request from a different
-// project.
+// A pointer from the current span to another span in the same trace or in a
+// different trace. For example, this can be used in batching operations,
+// where a single batch handler processes multiple requests from different
+// traces or when the handler receives a request from a different project.
 type SpanLink struct {
 	// A unique identifier of a trace that this linked span is part of. The ID is a
 	// 16-byte array.

src/runtime/vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/status.go

@@ -3,19 +3,17 @@
 
 package telemetry
 
-// StatusCode is the status of a Span.
-//
 // For the semantics of status codes see
 // https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/trace/api.md#set-status
 type StatusCode int32
 
 const (
-	// StatusCodeUnset is the default status.
+	// The default status.
 	StatusCodeUnset StatusCode = 0
-	// StatusCodeOK is used when the Span has been validated by an Application
-	// developer or Operator to have completed successfully.
+	// The Span has been validated by an Application developer or Operator to
+	// have completed successfully.
 	StatusCodeOK StatusCode = 1
-	// StatusCodeError is used when the Span contains an error.
+	// The Span contains an error.
 	StatusCodeError StatusCode = 2
 )
 

src/runtime/vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/traces.go

@@ -71,7 +71,7 @@ func (td *Traces) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-// ResourceSpans is a collection of ScopeSpans from a Resource.
+// A collection of ScopeSpans from a Resource.
 type ResourceSpans struct {
 	// The resource for the spans in this message.
 	// If this field is not set then no resource info is known.
@@ -128,7 +128,7 @@ func (rs *ResourceSpans) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-// ScopeSpans is a collection of Spans produced by an InstrumentationScope.
+// A collection of Spans produced by an InstrumentationScope.
 type ScopeSpans struct {
 	// The instrumentation scope information for the spans in this message.
 	// Semantically when InstrumentationScope isn't set, it is equivalent with

src/runtime/vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/value.go

@@ -1,6 +1,8 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
+//go:generate stringer -type=ValueKind -trimprefix=ValueKind
+
 package telemetry
 
 import (
@@ -21,7 +23,7 @@ import (
 // A zero value is valid and represents an empty value.
 type Value struct {
 	// Ensure forward compatibility by explicitly making this not comparable.
-	noCmp [0]func() //nolint:unused  // This is indeed used.
+	noCmp [0]func() //nolint: unused  // This is indeed used.
 
 	// num holds the value for Int64, Float64, and Bool. It holds the length
 	// for String, Bytes, Slice, Map.
@@ -90,7 +92,7 @@ func IntValue(v int) Value { return Int64Value(int64(v)) }
 
 // Int64Value returns a [Value] for an int64.
 func Int64Value(v int64) Value {
-	return Value{num: uint64(v), any: ValueKindInt64} //nolint:gosec  // Raw value conv.
+	return Value{num: uint64(v), any: ValueKindInt64}
 }
 
 // Float64Value returns a [Value] for a float64.
@@ -162,7 +164,7 @@ func (v Value) AsInt64() int64 {
 // this will return garbage.
 func (v Value) asInt64() int64 {
 	// Assumes v.num was a valid int64 (overflow not checked).
-	return int64(v.num) //nolint:gosec  // Bounded.
+	return int64(v.num) // nolint: gosec
 }
 
 // AsBool returns the value held by v as a bool.
@@ -307,13 +309,13 @@ func (v Value) String() string {
 		return v.asString()
 	case ValueKindInt64:
 		// Assumes v.num was a valid int64 (overflow not checked).
-		return strconv.FormatInt(int64(v.num), 10) //nolint:gosec  // Bounded.
+		return strconv.FormatInt(int64(v.num), 10) // nolint: gosec
 	case ValueKindFloat64:
 		return strconv.FormatFloat(v.asFloat64(), 'g', -1, 64)
 	case ValueKindBool:
 		return strconv.FormatBool(v.asBool())
 	case ValueKindBytes:
-		return string(v.asBytes())
+		return fmt.Sprint(v.asBytes())
 	case ValueKindMap:
 		return fmt.Sprint(v.asMap())
 	case ValueKindSlice:
@@ -341,7 +343,7 @@ func (v *Value) MarshalJSON() ([]byte, error) {
 	case ValueKindInt64:
 		return json.Marshal(struct {
 			Value string `json:"intValue"`
-		}{strconv.FormatInt(int64(v.num), 10)}) //nolint:gosec  // Raw value conv.
+		}{strconv.FormatInt(int64(v.num), 10)})
 	case ValueKindFloat64:
 		return json.Marshal(struct {
 			Value float64 `json:"doubleValue"`

src/runtime/vendor/go.opentelemetry.io/auto/sdk/span.go

@@ -6,7 +6,6 @@ package sdk
 import (
 	"encoding/json"
 	"fmt"
-	"math"
 	"reflect"
 	"runtime"
 	"strings"
@@ -17,7 +16,7 @@ import (
 
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/codes"
-	semconv "go.opentelemetry.io/otel/semconv/v1.37.0"
+	semconv "go.opentelemetry.io/otel/semconv/v1.26.0"
 	"go.opentelemetry.io/otel/trace"
 	"go.opentelemetry.io/otel/trace/noop"
 
@@ -86,12 +85,7 @@ func (s *span) SetAttributes(attrs ...attribute.KeyValue) {
 	limit := maxSpan.Attrs
 	if limit == 0 {
 		// No attributes allowed.
-		n := int64(len(attrs))
-		if n > 0 {
-			s.span.DroppedAttrs += uint32( //nolint:gosec  // Bounds checked.
-				min(n, math.MaxUint32),
-			)
-		}
+		s.span.DroppedAttrs += uint32(len(attrs))
 		return
 	}
 
@@ -127,13 +121,8 @@ func (s *span) SetAttributes(attrs ...attribute.KeyValue) {
 // convCappedAttrs converts up to limit attrs into a []telemetry.Attr. The
 // number of dropped attributes is also returned.
 func convCappedAttrs(limit int, attrs []attribute.KeyValue) ([]telemetry.Attr, uint32) {
-	n := len(attrs)
 	if limit == 0 {
-		var out uint32
-		if n > 0 {
-			out = uint32(min(int64(n), math.MaxUint32)) //nolint:gosec  // Bounds checked.
-		}
-		return nil, out
+		return nil, uint32(len(attrs))
 	}
 
 	if limit < 0 {
@@ -141,12 +130,8 @@ func convCappedAttrs(limit int, attrs []attribute.KeyValue) ([]telemetry.Attr, u
 		return convAttrs(attrs), 0
 	}
 
-	if n < 0 {
-		n = 0
-	}
-
-	limit = min(n, limit)
-	return convAttrs(attrs[:limit]), uint32(n - limit) //nolint:gosec  // Bounds checked.
+	limit = min(len(attrs), limit)
+	return convAttrs(attrs[:limit]), uint32(len(attrs) - limit)
 }
 
 func convAttrs(attrs []attribute.KeyValue) []telemetry.Attr {

src/runtime/vendor/go.opentelemetry.io/auto/sdk/tracer.go

@@ -5,7 +5,6 @@ package sdk
 
 import (
 	"context"
-	"math"
 	"time"
 
 	"go.opentelemetry.io/otel/trace"
@@ -22,20 +21,15 @@ type tracer struct {
 
 var _ trace.Tracer = tracer{}
 
-func (t tracer) Start(
-	ctx context.Context,
-	name string,
-	opts ...trace.SpanStartOption,
-) (context.Context, trace.Span) {
-	var psc, sc trace.SpanContext
+func (t tracer) Start(ctx context.Context, name string, opts ...trace.SpanStartOption) (context.Context, trace.Span) {
+	var psc trace.SpanContext
 	sampled := true
 	span := new(span)
 
 	// Ask eBPF for sampling decision and span context info.
-	t.start(ctx, span, &psc, &sampled, &sc)
+	t.start(ctx, span, &psc, &sampled, &span.spanContext)
 
 	span.sampled.Store(sampled)
-	span.spanContext = sc
 
 	ctx = trace.ContextWithSpan(ctx, span)
 
@@ -64,13 +58,7 @@ func (t *tracer) start(
 // start is used for testing.
 var start = func(context.Context, *span, *trace.SpanContext, *bool, *trace.SpanContext) {}
 
-var intToUint32Bound = min(math.MaxInt, math.MaxUint32)
-
-func (t tracer) traces(
-	name string,
-	cfg trace.SpanConfig,
-	sc, psc trace.SpanContext,
-) (*telemetry.Traces, *telemetry.Span) {
+func (t tracer) traces(name string, cfg trace.SpanConfig, sc, psc trace.SpanContext) (*telemetry.Traces, *telemetry.Span) {
 	span := &telemetry.Span{
 		TraceID:      telemetry.TraceID(sc.TraceID()),
 		SpanID:       telemetry.SpanID(sc.SpanID()),
@@ -85,16 +73,11 @@ func (t tracer) traces(
 
 	links := cfg.Links()
 	if limit := maxSpan.Links; limit == 0 {
-		n := len(links)
-		if n > 0 {
-			bounded := max(min(n, intToUint32Bound), 0)
-			span.DroppedLinks = uint32(bounded) //nolint:gosec  // Bounds checked.
-		}
+		span.DroppedLinks = uint32(len(links))
 	} else {
 		if limit > 0 {
 			n := max(len(links)-limit, 0)
-			bounded := min(n, intToUint32Bound)
-			span.DroppedLinks = uint32(bounded) //nolint:gosec  // Bounds checked.
+			span.DroppedLinks = uint32(n)
 			links = links[n:]
 		}
 		span.Links = convLinks(links)

src/runtime/vendor/go.opentelemetry.io/otel/.clomonitor.yml

@@ -1,3 +0,0 @@
-exemptions:
-  - check: artifacthub_badge
-    reason: "Artifact Hub doesn't support Go packages"

src/runtime/vendor/go.opentelemetry.io/otel/.codespellignore

@@ -7,5 +7,3 @@ ans
 nam
 valu
 thirdparty
-addOpt
-observ

src/runtime/vendor/go.opentelemetry.io/otel/.golangci.yml

@@ -1,267 +1,252 @@
-version: "2"
+# See https://github.com/golangci/golangci-lint#config-file
 run:
-  issues-exit-code: 1
-  tests: true
+  issues-exit-code: 1 #Default
+  tests: true #Default
+
 linters:
-  default: none
+  # Disable everything by default so upgrades to not include new "default
+  # enabled" linters.
+  disable-all: true
+  # Specifically enable linters we want to use.
   enable:
     - asasalint
     - bodyclose
     - depguard
     - errcheck
     - errorlint
-    - gocritic
     - godot
+    - gofumpt
+    - goimports
     - gosec
+    - gosimple
     - govet
     - ineffassign
     - misspell
-    - modernize
     - perfsprint
     - revive
     - staticcheck
     - testifylint
+    - typecheck
     - unconvert
-    - unparam
     - unused
+    - unparam
     - usestdlibvars
     - usetesting
-  settings:
-    depguard:
-      rules:
-        auto/sdk:
-          files:
-            - '!internal/global/trace.go'
-            - ~internal/global/trace_test.go
-          deny:
-            - pkg: go.opentelemetry.io/auto/sdk
-              desc: Do not use SDK from automatic instrumentation.
-        non-tests:
-          files:
-            - '!$test'
-            - '!**/*test/*.go'
-            - '!**/internal/matchers/*.go'
-          deny:
-            - pkg: testing
-            - pkg: github.com/stretchr/testify
-            - pkg: crypto/md5
-            - pkg: crypto/sha1
-            - pkg: crypto/**/pkix
-        otel-internal:
-          files:
-            - '**/sdk/*.go'
-            - '**/sdk/**/*.go'
-            - '**/exporters/*.go'
-            - '**/exporters/**/*.go'
-            - '**/schema/*.go'
-            - '**/schema/**/*.go'
-            - '**/metric/*.go'
-            - '**/metric/**/*.go'
-            - '**/bridge/*.go'
-            - '**/bridge/**/*.go'
-            - '**/trace/*.go'
-            - '**/trace/**/*.go'
-            - '**/log/*.go'
-            - '**/log/**/*.go'
-          deny:
-            - pkg: go.opentelemetry.io/otel/internal$
-              desc: Do not use cross-module internal packages.
-            - pkg: go.opentelemetry.io/otel/internal/internaltest
-              desc: Do not use cross-module internal packages.
-        otlp-internal:
-          files:
-            - '!**/exporters/otlp/internal/**/*.go'
-          deny:
-            - pkg: go.opentelemetry.io/otel/exporters/otlp/internal
-              desc: Do not use cross-module internal packages.
-        otlpmetric-internal:
-          files:
-            - '!**/exporters/otlp/otlpmetric/internal/*.go'
-            - '!**/exporters/otlp/otlpmetric/internal/**/*.go'
-          deny:
-            - pkg: go.opentelemetry.io/otel/exporters/otlp/otlpmetric/internal
-              desc: Do not use cross-module internal packages.
-        otlptrace-internal:
-          files:
-            - '!**/exporters/otlp/otlptrace/*.go'
-            - '!**/exporters/otlp/otlptrace/internal/**.go'
-          deny:
-            - pkg: go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal
-              desc: Do not use cross-module internal packages.
-    gocritic:
-      disabled-checks:
-        - appendAssign
-        - commentedOutCode
-        - dupArg
-        - hugeParam
-        - importShadow
-        - preferDecodeRune
-        - rangeValCopy
-        - unnamedResult
-        - whyNoLint
-      enable-all: true
-    godot:
-      exclude:
-        # Exclude links.
-        - '^ *\[[^]]+\]:'
-        # Exclude sentence fragments for lists.
-        - ^[ ]*[-•]
-        # Exclude sentences prefixing a list.
-        - :$
-    misspell:
-      locale: US
-      ignore-rules:
-        - cancelled
-    modernize:
-      disable:
-        - omitzero
-    perfsprint:
-      int-conversion: true
-      err-error: true
-      errorf: true
-      sprintf1: true
-      strconcat: true
-    revive:
-      confidence: 0.01
-      rules:
-        - name: blank-imports
-        - name: bool-literal-in-expr
-        - name: constant-logical-expr
-        - name: context-as-argument
-          arguments:
-            - allowTypesBefore: '*testing.T'
-          disabled: true
-        - name: context-keys-type
-        - name: deep-exit
-        - name: defer
-          arguments:
-            - - call-chain
-              - loop
-        - name: dot-imports
-        - name: duplicated-imports
-        - name: early-return
-          arguments:
-            - preserveScope
-        - name: empty-block
-        - name: empty-lines
-        - name: error-naming
-        - name: error-return
-        - name: error-strings
-        - name: errorf
-        - name: exported
-          arguments:
-            - sayRepetitiveInsteadOfStutters
-        - name: flag-parameter
-        - name: identical-branches
-        - name: if-return
-        - name: import-shadowing
-        - name: increment-decrement
-        - name: indent-error-flow
-          arguments:
-            - preserveScope
-        - name: package-comments
-        - name: range
-        - name: range-val-in-closure
-        - name: range-val-address
-        - name: redefines-builtin-id
-        - name: string-format
-          arguments:
-            - - panic
-              - /^[^\n]*$/
-              - must not contain line breaks
-        - name: struct-tag
-        - name: superfluous-else
-          arguments:
-            - preserveScope
-        - name: time-equal
-        - name: unconditional-recursion
-        - name: unexported-return
-        - name: unhandled-error
-          arguments:
-            - fmt.Fprint
-            - fmt.Fprintf
-            - fmt.Fprintln
-            - fmt.Print
-            - fmt.Printf
-            - fmt.Println
-        - name: unused-parameter
-        - name: unused-receiver
-        - name: unnecessary-stmt
-        - name: use-any
-        - name: useless-break
-        - name: var-declaration
-        - name: var-naming
-          arguments:
-            - ["ID"] # AllowList
-            - ["Otel", "Aws", "Gcp"] # DenyList
-        - name: waitgroup-by-value
-    testifylint:
-      enable-all: true
-      disable:
-        - float-compare
-        - go-require
-        - require-error
-    usetesting:
-      context-background: true
-      context-todo: true
-  exclusions:
-    generated: lax
-    presets:
-      - common-false-positives
-      - legacy
-      - std-error-handling
-    rules:
-      - linters:
-          - revive
-        path: schema/v.*/types/.*
-        text: avoid meaningless package names
-      # TODO: Having appropriate comments for exported objects helps development,
-      # even for objects in internal packages. Appropriate comments for all
-      # exported objects should be added and this exclusion removed.
-      - linters:
-          - revive
-        path: .*internal/.*
-        text: exported (method|function|type|const) (.+) should have comment or be unexported
-      # Yes, they are, but it's okay in a test.
-      - linters:
-          - revive
-        path: _test\.go
-        text: exported func.*returns unexported type.*which can be annoying to use
-      # Example test functions should be treated like main.
-      - linters:
-          - revive
-        path: example.*_test\.go
-        text: calls to (.+) only in main[(][)] or init[(][)] functions
-      # It's okay to not run gosec and perfsprint in a test.
-      - linters:
-          - gosec
-          - perfsprint
-        path: _test\.go
-      # Ignoring gosec G404: Use of weak random number generator (math/rand instead of crypto/rand)
-      # as we commonly use it in tests and examples.
-      - linters:
-          - gosec
-        text: 'G404:'
-      # Ignoring gosec G402: TLS MinVersion too low
-      # as the https://pkg.go.dev/crypto/tls#Config handles MinVersion default well.
-      - linters:
-          - gosec
-        text: 'G402: TLS MinVersion too low.'
+
 issues:
+  # Maximum issues count per one linter.
+  # Set to 0 to disable.
+  # Default: 50
+  # Setting to unlimited so the linter only is run once to debug all issues.
   max-issues-per-linter: 0
+  # Maximum count of issues with the same text.
+  # Set to 0 to disable.
+  # Default: 3
+  # Setting to unlimited so the linter only is run once to debug all issues.
   max-same-issues: 0
-formatters:
-  enable:
-    - gofumpt
-    - goimports
-    - golines
-  settings:
-    gofumpt:
-      extra-rules: true
-    goimports:
-      local-prefixes:
-        - go.opentelemetry.io/otel
-    golines:
-      max-len: 120
-  exclusions:
-    generated: lax
+  # Excluding configuration per-path, per-linter, per-text and per-source.
+  exclude-rules:
+    # TODO: Having appropriate comments for exported objects helps development,
+    # even for objects in internal packages. Appropriate comments for all
+    # exported objects should be added and this exclusion removed.
+    - path: '.*internal/.*'
+      text: "exported (method|function|type|const) (.+) should have comment or be unexported"
+      linters:
+        - revive
+    # Yes, they are, but it's okay in a test.
+    - path: _test\.go
+      text: "exported func.*returns unexported type.*which can be annoying to use"
+      linters:
+        - revive
+    # Example test functions should be treated like main.
+    - path: example.*_test\.go
+      text: "calls to (.+) only in main[(][)] or init[(][)] functions"
+      linters:
+        - revive
+    # It's okay to not run gosec and perfsprint in a test.
+    - path: _test\.go
+      linters:
+        - gosec
+        - perfsprint
+    # Ignoring gosec G404: Use of weak random number generator (math/rand instead of crypto/rand)
+    # as we commonly use it in tests and examples.
+    - text: "G404:"
+      linters:
+        - gosec
+    # Ignoring gosec G402: TLS MinVersion too low
+    # as the https://pkg.go.dev/crypto/tls#Config handles MinVersion default well.
+    - text: "G402: TLS MinVersion too low."
+      linters:
+        - gosec
+  include:
+    # revive exported should have comment or be unexported.
+    - EXC0012
+    # revive package comment should be of the form ...
+    - EXC0013
+
+linters-settings:
+  depguard:
+    rules:
+      non-tests:
+        files:
+          - "!$test"
+          - "!**/*test/*.go"
+          - "!**/internal/matchers/*.go"
+        deny:
+          - pkg: "testing"
+          - pkg: "github.com/stretchr/testify"
+          - pkg: "crypto/md5"
+          - pkg: "crypto/sha1"
+          - pkg: "crypto/**/pkix"
+      auto/sdk:
+        files:
+          - "!internal/global/trace.go"
+          - "~internal/global/trace_test.go"
+        deny:
+          - pkg: "go.opentelemetry.io/auto/sdk"
+            desc: Do not use SDK from automatic instrumentation.
+      otlp-internal:
+        files:
+          - "!**/exporters/otlp/internal/**/*.go"
+        deny:
+          - pkg: "go.opentelemetry.io/otel/exporters/otlp/internal"
+            desc: Do not use cross-module internal packages.
+      otlptrace-internal:
+        files:
+          - "!**/exporters/otlp/otlptrace/*.go"
+          - "!**/exporters/otlp/otlptrace/internal/**.go"
+        deny:
+          - pkg: "go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal"
+            desc: Do not use cross-module internal packages.
+      otlpmetric-internal:
+        files:
+          - "!**/exporters/otlp/otlpmetric/internal/*.go"
+          - "!**/exporters/otlp/otlpmetric/internal/**/*.go"
+        deny:
+          - pkg: "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/internal"
+            desc: Do not use cross-module internal packages.
+      otel-internal:
+        files:
+          - "**/sdk/*.go"
+          - "**/sdk/**/*.go"
+          - "**/exporters/*.go"
+          - "**/exporters/**/*.go"
+          - "**/schema/*.go"
+          - "**/schema/**/*.go"
+          - "**/metric/*.go"
+          - "**/metric/**/*.go"
+          - "**/bridge/*.go"
+          - "**/bridge/**/*.go"
+          - "**/trace/*.go"
+          - "**/trace/**/*.go"
+          - "**/log/*.go"
+          - "**/log/**/*.go"
+        deny:
+          - pkg: "go.opentelemetry.io/otel/internal$"
+            desc: Do not use cross-module internal packages.
+          - pkg: "go.opentelemetry.io/otel/internal/attribute"
+            desc: Do not use cross-module internal packages.
+          - pkg: "go.opentelemetry.io/otel/internal/internaltest"
+            desc: Do not use cross-module internal packages.
+          - pkg: "go.opentelemetry.io/otel/internal/matchers"
+            desc: Do not use cross-module internal packages.
+  godot:
+    exclude:
+      # Exclude links.
+      - '^ *\[[^]]+\]:'
+      # Exclude sentence fragments for lists.
+      - '^[ ]*[-•]'
+      # Exclude sentences prefixing a list.
+      - ':$'
+  goimports:
+    local-prefixes: go.opentelemetry.io
+  misspell:
+    locale: US
+    ignore-words:
+      - cancelled
+  perfsprint:
+    err-error: true
+    errorf: true
+    int-conversion: true
+    sprintf1: true
+    strconcat: true
+  revive:
+    # Sets the default failure confidence.
+    # This means that linting errors with less than 0.8 confidence will be ignored.
+    # Default: 0.8
+    confidence: 0.01
+    # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md
+    rules:
+      - name: blank-imports
+      - name: bool-literal-in-expr
+      - name: constant-logical-expr
+      - name: context-as-argument
+        disabled: true
+        arguments:
+          - allowTypesBefore: "*testing.T"
+      - name: context-keys-type
+      - name: deep-exit
+      - name: defer
+        arguments:
+          - ["call-chain", "loop"]
+      - name: dot-imports
+      - name: duplicated-imports
+      - name: early-return
+        arguments:
+          - "preserveScope"
+      - name: empty-block
+      - name: empty-lines
+      - name: error-naming
+      - name: error-return
+      - name: error-strings
+      - name: errorf
+      - name: exported
+        arguments:
+          - "sayRepetitiveInsteadOfStutters"
+      - name: flag-parameter
+      - name: identical-branches
+      - name: if-return
+      - name: import-shadowing
+      - name: increment-decrement
+      - name: indent-error-flow
+        arguments:
+          - "preserveScope"
+      - name: package-comments
+      - name: range
+      - name: range-val-in-closure
+      - name: range-val-address
+      - name: redefines-builtin-id
+      - name: string-format
+        arguments:
+          - - panic
+            - '/^[^\n]*$/'
+            - must not contain line breaks
+      - name: struct-tag
+      - name: superfluous-else
+        arguments:
+          - "preserveScope"
+      - name: time-equal
+      - name: unconditional-recursion
+      - name: unexported-return
+      - name: unhandled-error
+        arguments:
+          - "fmt.Fprint"
+          - "fmt.Fprintf"
+          - "fmt.Fprintln"
+          - "fmt.Print"
+          - "fmt.Printf"
+          - "fmt.Println"
+      - name: unnecessary-stmt
+      - name: useless-break
+      - name: var-declaration
+      - name: var-naming
+        arguments:
+          - ["ID"] # AllowList
+          - ["Otel", "Aws", "Gcp"] # DenyList
+      - name: waitgroup-by-value
+  testifylint:
+    enable-all: true
+    disable:
+      - float-compare
+      - go-require
+      - require-error

src/runtime/vendor/go.opentelemetry.io/otel/.lycheeignore

@@ -1,13 +1,6 @@
 http://localhost
-https://localhost
 http://jaeger-collector
 https://github.com/open-telemetry/opentelemetry-go/milestone/
 https://github.com/open-telemetry/opentelemetry-go/projects
-# Weaver model URL for semantic-conventions repository.
-https?:\/\/github\.com\/open-telemetry\/semantic-conventions\/archive\/refs\/tags\/[^.]+\.zip\[[^]]+]
 file:///home/runner/work/opentelemetry-go/opentelemetry-go/libraries
 file:///home/runner/work/opentelemetry-go/opentelemetry-go/manual
-http://4.3.2.1:78/user/123
-file:///home/runner/work/opentelemetry-go/opentelemetry-go/exporters/otlp/otlptrace/otlptracegrpc/internal/observ/dns:/:4317
-# URL works, but it has blocked link checkers.
-https://dl.acm.org/doi/10.1145/198429.198435

src/runtime/vendor/go.opentelemetry.io/otel/CHANGELOG.md

@@ -11,304 +11,6 @@ This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 <!-- Released section -->
 <!-- Don't change this section unless doing release -->
 
-## [1.40.0/0.62.0/0.16.0] 2026-02-02
-
-### Added
-
-- Add `AlwaysRecord` sampler in `go.opentelemetry.io/otel/sdk/trace`. (#7724)
-- Add `Enabled` method to all synchronous instrument interfaces (`Float64Counter`, `Float64UpDownCounter`, `Float64Histogram`, `Float64Gauge`, `Int64Counter`, `Int64UpDownCounter`, `Int64Histogram`, `Int64Gauge`,) in `go.opentelemetry.io/otel/metric`.
-  This stabilizes the synchronous instrument enabled feature, allowing users to check if an instrument will process measurements before performing computationally expensive operations. (#7763)
-- Add `go.opentelemetry.io/otel/semconv/v1.39.0` package.
-  The package contains semantic conventions from the `v1.39.0` version of the OpenTelemetry Semantic Conventions.
-  See the [migration documentation](./semconv/v1.39.0/MIGRATION.md) for information on how to upgrade from `go.opentelemetry.io/otel/semconv/v1.38.0.` (#7783, #7789)
-
-### Changed
-
-- Improve the concurrent performance of `HistogramReservoir` in `go.opentelemetry.io/otel/sdk/metric/exemplar` by 4x. (#7443)
-- Improve the concurrent performance of `FixedSizeReservoir` in `go.opentelemetry.io/otel/sdk/metric/exemplar`. (#7447)
-- Improve performance of concurrent histogram measurements in `go.opentelemetry.io/otel/sdk/metric`. (#7474)
-- Improve performance of concurrent synchronous gauge measurements in `go.opentelemetry.io/otel/sdk/metric`. (#7478)
-- Add experimental observability metrics in `go.opentelemetry.io/otel/exporters/stdout/stdoutmetric`. (#7492)
-- `Exporter` in `go.opentelemetry.io/otel/exporters/prometheus` ignores metrics with the scope `go.opentelemetry.io/contrib/bridges/prometheus`.
-  This prevents scrape failures when the Prometheus exporter is misconfigured to get data from the Prometheus bridge. (#7688)
-- Improve performance of concurrent exponential histogram measurements in `go.opentelemetry.io/otel/sdk/metric`. (#7702)
-- The `rpc.grpc.status_code` attribute in the experimental metrics emitted from `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc` is replaced with the `rpc.response.status_code` attribute to align with the semantic conventions. (#7854)
-- The `rpc.grpc.status_code` attribute in the experimental metrics emitted from `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc` is replaced with the `rpc.response.status_code` attribute to align with the semantic conventions. (#7854)
-
-### Fixed
-
-- Fix bad log message when key-value pairs are dropped because of key duplication in `go.opentelemetry.io/otel/sdk/log`. (#7662)
-- Fix `DroppedAttributes` on `Record` in `go.opentelemetry.io/otel/sdk/log` to not count the non-attribute key-value pairs dropped because of key duplication. (#7662)
-- Fix `SetAttributes` on `Record` in `go.opentelemetry.io/otel/sdk/log` to not log that attributes are dropped when they are actually not dropped. (#7662)
-- Fix missing `request.GetBody` in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` to correctly handle HTTP/2 `GOAWAY` frame. (#7794)
-- `WithHostID` detector in `go.opentelemetry.io/otel/sdk/resource` to use full path for `ioreg` command on Darwin (macOS). (#7818)
-
-### Deprecated
-
-- Deprecate `go.opentelemetry.io/otel/exporters/zipkin`.
-  For more information, see the [OTel blog post deprecating the Zipkin exporter](https://opentelemetry.io/blog/2025/deprecating-zipkin-exporters/). (#7670)
-
-## [1.39.0/0.61.0/0.15.0/0.0.14] 2025-12-05
-
-### Added
-
-- Greatly reduce the cost of recording metrics in `go.opentelemetry.io/otel/sdk/metric` using hashing for map keys. (#7175)
-- Add `WithInstrumentationAttributeSet` option to `go.opentelemetry.io/otel/log`, `go.opentelemetry.io/otel/metric`, and `go.opentelemetry.io/otel/trace` packages.
-  This provides a concurrent-safe and performant alternative to `WithInstrumentationAttributes` by accepting a pre-constructed `attribute.Set`. (#7287)
-- Add experimental observability for the Prometheus exporter in `go.opentelemetry.io/otel/exporters/prometheus`.
-  Check the `go.opentelemetry.io/otel/exporters/prometheus/internal/x` package documentation for more information. (#7345)
-- Add experimental observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`. (#7353)
-- Add temporality selector functions `DeltaTemporalitySelector`, `CumulativeTemporalitySelector`, `LowMemoryTemporalitySelector` to `go.opentelemetry.io/otel/sdk/metric`. (#7434)
-- Add experimental observability metrics for simple log processor in `go.opentelemetry.io/otel/sdk/log`. (#7548)
-- Add experimental observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`. (#7459)
-- Add experimental observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`. (#7486)
-- Add experimental observability metrics for simple span processor in `go.opentelemetry.io/otel/sdk/trace`. (#7374)
-- Add experimental observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. (#7512)
-- Add experimental observability metrics for manual reader in `go.opentelemetry.io/otel/sdk/metric`. (#7524)
-- Add experimental observability metrics for periodic reader in `go.opentelemetry.io/otel/sdk/metric`. (#7571)
-- Support `OTEL_EXPORTER_OTLP_LOGS_INSECURE` and `OTEL_EXPORTER_OTLP_INSECURE` environmental variables in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. (#7608)
-- Add `Enabled` method to the `Processor` interface in `go.opentelemetry.io/otel/sdk/log`.
-  All `Processor` implementations now include an `Enabled` method. (#7639)
-- The `go.opentelemetry.io/otel/semconv/v1.38.0` package.
-  The package contains semantic conventions from the `v1.38.0` version of the OpenTelemetry Semantic Conventions.
-  See the [migration documentation](./semconv/v1.38.0/MIGRATION.md) for information on how to upgrade from `go.opentelemetry.io/otel/semconv/v1.37.0.`(#7648)
-
-### Changed
-
-- `Distinct` in `go.opentelemetry.io/otel/attribute` is no longer guaranteed to uniquely identify an attribute set.
-  Collisions between `Distinct` values for different Sets are possible with extremely high cardinality (billions of series per instrument), but are highly unlikely. (#7175)
-- `WithInstrumentationAttributes` in `go.opentelemetry.io/otel/trace` synchronously de-duplicates the passed attributes instead of delegating it to the returned `TracerOption`. (#7266)
-- `WithInstrumentationAttributes` in `go.opentelemetry.io/otel/meter` synchronously de-duplicates the passed attributes instead of delegating it to the returned `MeterOption`. (#7266)
-- `WithInstrumentationAttributes` in `go.opentelemetry.io/otel/log` synchronously de-duplicates the passed attributes instead of delegating it to the returned `LoggerOption`. (#7266)
-- Rename the `OTEL_GO_X_SELF_OBSERVABILITY` environment variable to `OTEL_GO_X_OBSERVABILITY` in `go.opentelemetry.io/otel/sdk/trace`, `go.opentelemetry.io/otel/sdk/log`, and `go.opentelemetry.io/otel/exporters/stdout/stdouttrace`. (#7302)
-- Improve performance of histogram `Record` in `go.opentelemetry.io/otel/sdk/metric` when min and max are disabled using `NoMinMax`. (#7306)
-- Improve error handling for dropped data during translation by using `prometheus.NewInvalidMetric` in `go.opentelemetry.io/otel/exporters/prometheus`.
-  ⚠️ **Breaking Change:** Previously, these cases were only logged and scrapes succeeded.
-  Now, when translation would drop data (e.g., invalid label/value), the exporter emits a `NewInvalidMetric`, and Prometheus scrapes **fail with HTTP 500** by default.
-  To preserve the prior behavior (scrapes succeed while errors are logged), configure your Prometheus HTTP handler with: `promhttp.HandlerOpts{ ErrorHandling: promhttp.ContinueOnError }`. (#7363)
-- Replace fnv hash with xxhash in `go.opentelemetry.io/otel/attribute` for better performance. (#7371)
-- The default `TranslationStrategy` in `go.opentelemetry.io/exporters/prometheus` is changed from `otlptranslator.NoUTF8EscapingWithSuffixes` to `otlptranslator.UnderscoreEscapingWithSuffixes`. (#7421)
-- Improve performance of concurrent measurements in `go.opentelemetry.io/otel/sdk/metric`. (#7427)
-- Include W3C TraceFlags (bits 0–7) in the OTLP `Span.Flags` field in `go.opentelemetry.io/exporters/otlp/otlptrace/otlptracehttp` and `go.opentelemetry.io/exporters/otlp/otlptrace/otlptracegrpc`. (#7438)
-- The `ErrorType` function in `go.opentelemetry.io/otel/semconv/v1.37.0` now handles custom error types.
-  If an error implements an `ErrorType() string` method, the return value of that method will be used as the error type. (#7442)
-
-### Fixed
-
-- Fix `WithInstrumentationAttributes` options in `go.opentelemetry.io/otel/trace`, `go.opentelemetry.io/otel/metric`, and `go.opentelemetry.io/otel/log` to properly merge attributes when passed multiple times instead of replacing them.
-  Attributes with duplicate keys will use the last value passed. (#7300)
-- The equality of `attribute.Set` when using the `Equal` method is not affected by the user overriding the empty set pointed to by `attribute.EmptySet` in `go.opentelemetry.io/otel/attribute`. (#7357)
-- Return partial OTLP export errors to the caller in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`. (#7372)
-- Return partial OTLP export errors to the caller in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. (#7372)
-- Return partial OTLP export errors to the caller in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc`. (#7372)
-- Return partial OTLP export errors to the caller in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`. (#7372)
-- Return partial OTLP export errors to the caller in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`. (#7372)
-- Return partial OTLP export errors to the caller in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`. (#7372)
-- Fix `AddAttributes`, `SetAttributes`, `SetBody` on `Record` in `go.opentelemetry.io/otel/sdk/log` to not mutate input. (#7403)
-- Do not double record measurements of `RecordSet` methods in `go.opentelemetry.io/otel/semconv/v1.37.0`. (#7655)
-- Do not double record measurements of `RecordSet` methods in `go.opentelemetry.io/otel/semconv/v1.36.0`. (#7656)
-
-### Removed
-
-- Drop support for [Go 1.23]. (#7274)
-- Remove the `FilterProcessor` interface in `go.opentelemetry.io/otel/sdk/log`.
-  The `Enabled` method has been added to the `Processor` interface instead.
-  All `Processor` implementations must now implement the `Enabled` method.
-  Custom processors that do not filter records can implement `Enabled` to return `true`. (#7639)
-
-## [1.38.0/0.60.0/0.14.0/0.0.13] 2025-08-29
-
-This release is the last to support [Go 1.23].
-The next release will require at least [Go 1.24].
-
-### Added
-
-- Add native histogram exemplar support in `go.opentelemetry.io/otel/exporters/prometheus`. (#6772)
-- Add template attribute functions to the `go.opentelmetry.io/otel/semconv/v1.34.0` package. (#6939)
-  - `ContainerLabel`
-  - `DBOperationParameter`
-  - `DBSystemParameter`
-  - `HTTPRequestHeader`
-  - `HTTPResponseHeader`
-  - `K8SCronJobAnnotation`
-  - `K8SCronJobLabel`
-  - `K8SDaemonSetAnnotation`
-  - `K8SDaemonSetLabel`
-  - `K8SDeploymentAnnotation`
-  - `K8SDeploymentLabel`
-  - `K8SJobAnnotation`
-  - `K8SJobLabel`
-  - `K8SNamespaceAnnotation`
-  - `K8SNamespaceLabel`
-  - `K8SNodeAnnotation`
-  - `K8SNodeLabel`
-  - `K8SPodAnnotation`
-  - `K8SPodLabel`
-  - `K8SReplicaSetAnnotation`
-  - `K8SReplicaSetLabel`
-  - `K8SStatefulSetAnnotation`
-  - `K8SStatefulSetLabel`
-  - `ProcessEnvironmentVariable`
-  - `RPCConnectRPCRequestMetadata`
-  - `RPCConnectRPCResponseMetadata`
-  - `RPCGRPCRequestMetadata`
-  - `RPCGRPCResponseMetadata`
-- Add `ErrorType` attribute helper function to the `go.opentelmetry.io/otel/semconv/v1.34.0` package. (#6962)
-- Add `WithAllowKeyDuplication` in `go.opentelemetry.io/otel/sdk/log` which can be used to disable deduplication for log records. (#6968)
-- Add `WithCardinalityLimit` option to configure the cardinality limit in `go.opentelemetry.io/otel/sdk/metric`. (#6996, #7065, #7081, #7164, #7165, #7179)
-- Add `Clone` method to `Record` in `go.opentelemetry.io/otel/log` that returns a copy of the record with no shared state. (#7001)
-- Add experimental self-observability span and batch span processor metrics in `go.opentelemetry.io/otel/sdk/trace`.
-  Check the `go.opentelemetry.io/otel/sdk/trace/internal/x` package documentation for more information. (#7027, #6393, #7209)
-- The `go.opentelemetry.io/otel/semconv/v1.36.0` package.
-  The package contains semantic conventions from the `v1.36.0` version of the OpenTelemetry Semantic Conventions.
-  See the [migration documentation](./semconv/v1.36.0/MIGRATION.md) for information on how to upgrade from `go.opentelemetry.io/otel/semconv/v1.34.0.`(#7032, #7041)
-- Add support for configuring Prometheus name translation using `WithTranslationStrategy` option in `go.opentelemetry.io/otel/exporters/prometheus`. The current default translation strategy when UTF-8 mode is enabled is `NoUTF8EscapingWithSuffixes`, but a future release will change the default strategy to `UnderscoreEscapingWithSuffixes` for compliance with the specification. (#7111)
-- Add experimental self-observability log metrics in `go.opentelemetry.io/otel/sdk/log`.
-  Check the `go.opentelemetry.io/otel/sdk/log/internal/x` package documentation for more information. (#7121)
-- Add experimental self-observability trace exporter metrics in `go.opentelemetry.io/otel/exporters/stdout/stdouttrace`.
-  Check the `go.opentelemetry.io/otel/exporters/stdout/stdouttrace/internal/x` package documentation for more information. (#7133)
-- Support testing of [Go 1.25]. (#7187)
-- The `go.opentelemetry.io/otel/semconv/v1.37.0` package.
-  The package contains semantic conventions from the `v1.37.0` version of the OpenTelemetry Semantic Conventions.
-  See the [migration documentation](./semconv/v1.37.0/MIGRATION.md) for information on how to upgrade from `go.opentelemetry.io/otel/semconv/v1.36.0.`(#7254)
-
-### Changed
-
-- Optimize `TraceIDFromHex` and `SpanIDFromHex` in `go.opentelemetry.io/otel/sdk/trace`. (#6791)
-- Change `AssertEqual` in `go.opentelemetry.io/otel/log/logtest` to accept `TestingT` in order to support benchmarks and fuzz tests. (#6908)
-- Change `DefaultExemplarReservoirProviderSelector` in `go.opentelemetry.io/otel/sdk/metric` to use `runtime.GOMAXPROCS(0)` instead of `runtime.NumCPU()` for the `FixedSizeReservoirProvider` default size. (#7094)
-
-### Fixed
-
-- `SetBody` method of `Record` in `go.opentelemetry.io/otel/sdk/log` now deduplicates key-value collections (`log.Value` of `log.KindMap` from `go.opentelemetry.io/otel/log`). (#7002)
-- Fix `go.opentelemetry.io/otel/exporters/prometheus` to not append a suffix if it's already present in metric name. (#7088)
-- Fix the `go.opentelemetry.io/otel/exporters/stdout/stdouttrace` self-observability component type and name. (#7195)
-- Fix partial export count metric in `go.opentelemetry.io/otel/exporters/stdout/stdouttrace`. (#7199)
-
-### Deprecated
-
-- Deprecate `WithoutUnits` and `WithoutCounterSuffixes` options, preferring `WithTranslationStrategy` instead. (#7111)
-- Deprecate support for `OTEL_GO_X_CARDINALITY_LIMIT` environment variable in `go.opentelemetry.io/otel/sdk/metric`. Use `WithCardinalityLimit` option instead. (#7166)
-
-## [0.59.1] 2025-07-21
-
-### Changed
-
-- Retract `v0.59.0` release of `go.opentelemetry.io/otel/exporters/prometheus` module which appends incorrect unit suffixes. (#7046)
-- Change `go.opentelemetry.io/otel/exporters/prometheus` to no longer deduplicate suffixes when UTF8 is enabled.
-  It is recommended to disable unit and counter suffixes in the exporter, and manually add suffixes if you rely on the existing behavior. (#7044)
-
-### Fixed
-
-- Fix `go.opentelemetry.io/otel/exporters/prometheus` to properly handle unit suffixes when the unit is in brackets.
-  E.g. `{spans}`. (#7044)
-
-## [1.37.0/0.59.0/0.13.0] 2025-06-25
-
-### Added
-
-- The `go.opentelemetry.io/otel/semconv/v1.33.0` package.
-  The package contains semantic conventions from the `v1.33.0` version of the OpenTelemetry Semantic Conventions.
-  See the [migration documentation](./semconv/v1.33.0/MIGRATION.md) for information on how to upgrade from `go.opentelemetry.io/otel/semconv/v1.32.0.`(#6799)
-- The `go.opentelemetry.io/otel/semconv/v1.34.0` package.
-  The package contains semantic conventions from the `v1.34.0` version of the OpenTelemetry Semantic Conventions. (#6812)
-- Add metric's schema URL as `otel_scope_schema_url` label in `go.opentelemetry.io/otel/exporters/prometheus`. (#5947)
-- Add metric's scope attributes as `otel_scope_[attribute]` labels in `go.opentelemetry.io/otel/exporters/prometheus`. (#5947)
-- Add `EventName` to `EnabledParameters` in `go.opentelemetry.io/otel/log`. (#6825)
-- Add `EventName` to `EnabledParameters` in `go.opentelemetry.io/otel/sdk/log`. (#6825)
-- Changed handling of `go.opentelemetry.io/otel/exporters/prometheus` metric renaming to add unit suffixes when it doesn't match one of the pre-defined values in the unit suffix map. (#6839)
-
-### Changed
-
-- The semantic conventions have been upgraded from `v1.26.0` to `v1.34.0` in `go.opentelemetry.io/otel/bridge/opentracing`. (#6827)
-- The semantic conventions have been upgraded from `v1.26.0` to `v1.34.0` in `go.opentelemetry.io/otel/exporters/zipkin`. (#6829)
-- The semantic conventions have been upgraded from `v1.26.0` to `v1.34.0` in `go.opentelemetry.io/otel/metric`. (#6832)
-- The semantic conventions have been upgraded from `v1.26.0` to `v1.34.0` in `go.opentelemetry.io/otel/sdk/resource`. (#6834)
-- The semantic conventions have been upgraded from `v1.26.0` to `v1.34.0` in `go.opentelemetry.io/otel/sdk/trace`. (#6835)
-- The semantic conventions have been upgraded from `v1.26.0` to `v1.34.0` in `go.opentelemetry.io/otel/trace`. (#6836)
-- `Record.Resource` now returns `*resource.Resource` instead of `resource.Resource` in `go.opentelemetry.io/otel/sdk/log`. (#6864)
-- Retry now shows error cause for context timeout in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`, `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc`, `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`, `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`, `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`, `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. (#6898)
-
-### Fixed
-
-- Stop stripping trailing slashes from configured endpoint URL in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`. (#6710)
-- Stop stripping trailing slashes from configured endpoint URL in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`. (#6710)
-- Stop stripping trailing slashes from configured endpoint URL in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc`. (#6710)
-- Stop stripping trailing slashes from configured endpoint URL in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`. (#6710)
-- Validate exponential histogram scale range for Prometheus compatibility in `go.opentelemetry.io/otel/exporters/prometheus`. (#6822)
-- Context cancellation during metric pipeline produce does not corrupt data in `go.opentelemetry.io/otel/sdk/metric`. (#6914)
-
-### Removed
-
-- `go.opentelemetry.io/otel/exporters/prometheus` no longer exports `otel_scope_info` metric. (#6770)
-
-## [0.12.2] 2025-05-22
-
-### Fixed
-
-- Retract `v0.12.0` release of `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc` module that contains invalid dependencies. (#6804)
-- Retract `v0.12.0` release of `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp` module that contains invalid dependencies. (#6804)
-- Retract `v0.12.0` release of `go.opentelemetry.io/otel/exporters/stdout/stdoutlog` module that contains invalid dependencies. (#6804)
-
-## [0.12.1] 2025-05-21
-
-### Fixes
-
-- Use the proper dependency version of `go.opentelemetry.io/otel/sdk/log/logtest` in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`. (#6800)
-- Use the proper dependency version of `go.opentelemetry.io/otel/sdk/log/logtest` in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. (#6800)
-- Use the proper dependency version of `go.opentelemetry.io/otel/sdk/log/logtest` in `go.opentelemetry.io/otel/exporters/stdout/stdoutlog`. (#6800)
-
-## [1.36.0/0.58.0/0.12.0] 2025-05-20
-
-### Added
-
-- Add exponential histogram support in `go.opentelemetry.io/otel/exporters/prometheus`. (#6421)
-- The `go.opentelemetry.io/otel/semconv/v1.31.0` package.
-  The package contains semantic conventions from the `v1.31.0` version of the OpenTelemetry Semantic Conventions.
-  See the [migration documentation](./semconv/v1.31.0/MIGRATION.md) for information on how to upgrade from `go.opentelemetry.io/otel/semconv/v1.30.0`. (#6479)
-- Add `Recording`, `Scope`, and `Record` types in `go.opentelemetry.io/otel/log/logtest`. (#6507)
-- Add `WithHTTPClient` option to configure the `http.Client` used by `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`. (#6751)
-- Add `WithHTTPClient` option to configure the `http.Client` used by `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`. (#6752)
-- Add `WithHTTPClient` option to configure the `http.Client` used by `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. (#6688)
-- Add `ValuesGetter` in `go.opentelemetry.io/otel/propagation`, a `TextMapCarrier` that supports retrieving multiple values for a single key. (#5973)
-- Add `Values` method to `HeaderCarrier` to implement the new `ValuesGetter` interface in `go.opentelemetry.io/otel/propagation`. (#5973)
-- Update `Baggage` in `go.opentelemetry.io/otel/propagation` to retrieve multiple values for a key when the carrier implements `ValuesGetter`. (#5973)
-- Add `AssertEqual` function in `go.opentelemetry.io/otel/log/logtest`. (#6662)
-- The `go.opentelemetry.io/otel/semconv/v1.32.0` package.
-  The package contains semantic conventions from the `v1.32.0` version of the OpenTelemetry Semantic Conventions.
-  See the [migration documentation](./semconv/v1.32.0/MIGRATION.md) for information on how to upgrade from `go.opentelemetry.io/otel/semconv/v1.31.0`(#6782)
-- Add `Transform` option in `go.opentelemetry.io/otel/log/logtest`. (#6794)
-- Add `Desc` option in `go.opentelemetry.io/otel/log/logtest`. (#6796)
-
-### Removed
-
-- Drop support for [Go 1.22]. (#6381, #6418)
-- Remove `Resource` field from `EnabledParameters` in `go.opentelemetry.io/otel/sdk/log`. (#6494)
-- Remove `RecordFactory` type from `go.opentelemetry.io/otel/log/logtest`. (#6492)
-- Remove `ScopeRecords`, `EmittedRecord`, and `RecordFactory` types from `go.opentelemetry.io/otel/log/logtest`. (#6507)
-- Remove `AssertRecordEqual` function in `go.opentelemetry.io/otel/log/logtest`, use `AssertEqual` instead. (#6662)
-
-### Changed
-
-- ⚠️ Update `github.com/prometheus/client_golang` to `v1.21.1`, which changes the `NameValidationScheme` to `UTF8Validation`.
-  This allows metrics names to keep original delimiters (e.g. `.`), rather than replacing with underscores.
-  This can be reverted by setting `github.com/prometheus/common/model.NameValidationScheme` to `LegacyValidation` in `github.com/prometheus/common/model`. (#6433)
-- Initialize map with `len(keys)` in `NewAllowKeysFilter` and `NewDenyKeysFilter` to avoid unnecessary allocations in `go.opentelemetry.io/otel/attribute`. (#6455)
-- `go.opentelemetry.io/otel/log/logtest` is now a separate Go module. (#6465)
-- `go.opentelemetry.io/otel/sdk/log/logtest` is now a separate Go module. (#6466)
-- `Recorder` in `go.opentelemetry.io/otel/log/logtest` no longer separately stores records emitted by loggers with the same instrumentation scope. (#6507)
-- Improve performance of `BatchProcessor` in `go.opentelemetry.io/otel/sdk/log` by not exporting when exporter cannot accept more. (#6569, #6641)
-
-### Deprecated
-
-- Deprecate support for `model.LegacyValidation` for `go.opentelemetry.io/otel/exporters/prometheus`. (#6449)
-
-### Fixes
-
-- Stop percent encoding header environment variables in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc` and `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. (#6392)
-- Ensure the `noopSpan.tracerProvider` method is not inlined in `go.opentelemetry.io/otel/trace` so the `go.opentelemetry.io/auto` instrumentation can instrument non-recording spans. (#6456)
-- Use a `sync.Pool` instead of allocating `metricdata.ResourceMetrics` in `go.opentelemetry.io/otel/exporters/prometheus`. (#6472)
-
 ## [1.35.0/0.57.0/0.11.0] 2025-03-05
 
 This release is the last to support [Go 1.22].
@@ -3535,15 +3237,7 @@ It contains api and sdk for trace and meter.
 - CircleCI build CI manifest files.
 - CODEOWNERS file to track owners of this project.
 
-[Unreleased]: https://github.com/open-telemetry/opentelemetry-go/compare/v1.40.0...HEAD
-[1.40.0/0.62.0/0.16.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.40.0
-[1.39.0/0.61.0/0.15.0/0.0.14]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.39.0
-[1.38.0/0.60.0/0.14.0/0.0.13]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.38.0
-[0.59.1]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/prometheus/v0.59.1
-[1.37.0/0.59.0/0.13.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.37.0
-[0.12.2]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/log/v0.12.2
-[0.12.1]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/log/v0.12.1
-[1.36.0/0.58.0/0.12.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.36.0
+[Unreleased]: https://github.com/open-telemetry/opentelemetry-go/compare/v1.35.0...HEAD
 [1.35.0/0.57.0/0.11.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.35.0
 [1.34.0/0.56.0/0.10.0]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.34.0
 [1.33.0/0.55.0/0.9.0/0.0.12]: https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.33.0
@@ -3635,7 +3329,6 @@ It contains api and sdk for trace and meter.
 
 <!-- Released section ended -->
 
-[Go 1.25]: https://go.dev/doc/go1.25
 [Go 1.24]: https://go.dev/doc/go1.24
 [Go 1.23]: https://go.dev/doc/go1.23
 [Go 1.22]: https://go.dev/doc/go1.22

src/runtime/vendor/go.opentelemetry.io/otel/CODEOWNERS

@@ -12,6 +12,6 @@
 #  https://help.github.com/en/articles/about-code-owners
 #
 
-* @MrAlias @XSAM @dashpole @pellared @dmathieu @flc1125
+* @MrAlias @XSAM @dashpole @pellared @dmathieu
 
 CODEOWNERS @MrAlias @pellared @dashpole @XSAM @dmathieu

src/runtime/vendor/go.opentelemetry.io/otel/CONTRIBUTING.md

@@ -54,8 +54,8 @@ go get -d go.opentelemetry.io/otel
 (This may print some warning about "build constraints exclude all Go
 files", just ignore it.)
 
-This will put the project in `${GOPATH}/src/go.opentelemetry.io/otel`.
-Alternatively, you can use `git` directly with:
+This will put the project in `${GOPATH}/src/go.opentelemetry.io/otel`. You
+can alternatively use `git` directly with:
 
 ```sh
 git clone https://github.com/open-telemetry/opentelemetry-go
@@ -65,7 +65,8 @@ git clone https://github.com/open-telemetry/opentelemetry-go
 that name is a kind of a redirector to GitHub that `go get` can
 understand, but `git` does not.)
 
-This will add the project as `opentelemetry-go` within the current directory.
+This would put the project in the `opentelemetry-go` directory in
+current working directory.
 
 Enter the newly created directory and add your fork as a new remote:
 
@@ -108,9 +109,10 @@ A PR is considered **ready to merge** when:
 
   This is not enforced through automation, but needs to be validated by the
   maintainer merging.
-  * At least one of the qualified approvals needs to be from an
-    [Approver]/[Maintainer] affiliated with a different company than the author
-    of the PR.
+  * The qualified approvals need to be from [Approver]s/[Maintainer]s
+    affiliated with different companies. Two qualified approvals from
+    [Approver]s or [Maintainer]s affiliated with the same company counts as a
+    single qualified approval.
   * PRs introducing changes that have already been discussed and consensus
     reached only need one qualified approval. The discussion and resolution
     needs to be linked to the PR.
@@ -165,11 +167,11 @@ guidelines](https://opentelemetry.io/docs/specs/otel/library-guidelines).
 ### Focus on Capabilities, Not Structure Compliance
 
 OpenTelemetry is an evolving specification, one where the desires and
-use cases are clear, but the methods to satisfy those use cases are
+use cases are clear, but the method to satisfy those uses cases are
 not.
 
 As such, Contributions should provide functionality and behavior that
-conforms to the specification, but the interface and structure are
+conforms to the specification, but the interface and structure is
 flexible.
 
 It is preferable to have contributions follow the idioms of the
@@ -191,35 +193,6 @@ should have `go test -bench` output in their description.
 should have [`benchstat`](https://pkg.go.dev/golang.org/x/perf/cmd/benchstat)
 output in their description.
 
-## Dependencies
-
-This project uses [Go Modules] for dependency management. All modules will use
-`go.mod` to explicitly list all direct and indirect dependencies, ensuring a
-clear dependency graph. The `go.sum` file for each module will be committed to
-the repository and used to verify the integrity of downloaded modules,
-preventing malicious tampering.
-
-This project uses automated dependency update tools (i.e. dependabot,
-renovatebot) to manage updates to dependencies. This ensures that dependencies
-are kept up-to-date with the latest security patches and features and are
-reviewed before being merged. If you would like to propose a change to a
-dependency it should be done through a pull request that updates the `go.mod`
-file and includes a description of the change.
-
-See the [versioning and compatibility](./VERSIONING.md) policy for more details
-about dependency compatibility.
-
-[Go Modules]: https://pkg.go.dev/cmd/go#hdr-Modules__module_versions__and_more
-
-### Environment Dependencies
-
-This project does not partition dependencies based on the environment (i.e.
-`development`, `staging`, `production`).
-
-Only the dependencies explicitly included in the released modules have been
-tested and verified to work with the released code. No other guarantee is made
-about the compatibility of other dependencies.
-
 ## Documentation
 
 Each (non-internal, non-test) package must be documented using
@@ -261,10 +234,6 @@ For a non-comprehensive but foundational overview of these best practices
 the [Effective Go](https://golang.org/doc/effective_go.html) documentation
 is an excellent starting place.
 
-We also recommend following the
-[Go Code Review Comments](https://go.dev/wiki/CodeReviewComments)
-that collects common comments made during reviews of Go code.
-
 As a convenience for developers building this project the `make precommit`
 will format, lint, validate, and in some cases fix the changes you plan to
 submit. This check will need to pass for your changes to be able to be
@@ -618,10 +587,6 @@ See also:
 
 ### Testing
 
-We allow using [`testify`](https://github.com/stretchr/testify) even though
-it is seen as non-idiomatic according to
-the [Go Test Comments](https://go.dev/wiki/TestComments#assert-libraries) page.
-
 The tests should never leak goroutines.
 
 Use the term `ConcurrentSafe` in the test name when it aims to verify the
@@ -634,8 +599,8 @@ is not in their root name.
 
 The use of internal packages should be scoped to a single module. A sub-module
 should never import from a parent internal package. This creates a coupling
-between the two modules where a user can upgrade the parent without the child,
-and if the internal package API has changed, it will fail to upgrade[^3].
+between the two modules where a user can upgrade the parent without the child
+and if the internal package API has changed it will fail to upgrade[^3].
 
 There are two known exceptions to this rule:
 
@@ -656,7 +621,7 @@ this.
 
 ### Ignoring context cancellation
 
-OpenTelemetry API implementations need to ignore the cancellation of the context that is
+OpenTelemetry API implementations need to ignore the cancellation of the context that are
 passed when recording a value (e.g. starting a span, recording a measurement, emitting a log).
 Recording methods should not return an error describing the cancellation state of the context
 when they complete, nor should they abort any work.
@@ -674,478 +639,32 @@ force flushing telemetry, shutting down a signal provider) the context cancellat
 should be honored. This means all work done on behalf of the user provided context
 should be canceled.
 
-### Observability
-
-OpenTelemetry Go SDK components should be instrumented to enable users observability for the health and performance of the telemetry pipeline itself.
-This allows operators to understand how well their observability infrastructure is functioning and to identify potential issues before they impact their applications.
-
-This section outlines the best practices for building instrumentation in OpenTelemetry Go SDK components.
-
-#### Environment Variable Activation
-
-Observability features are currently experimental.
-They should be disabled by default and activated through the `OTEL_GO_X_OBSERVABILITY` environment variable.
-This follows the established experimental feature pattern used throughout the SDK.
-
-Components should check for this environment variable using a consistent pattern:
-
-```go
-import "go.opentelemetry.io/otel/*/internal/x"
-
-if x.Observability.Enabled() {
-    // Initialize observability metrics
-}
-```
-
-**References**:
-
-- [stdouttrace exporter](./exporters/stdout/stdouttrace/internal/x/x.go)
-- [sdk](./sdk/internal/x/x.go)
-
-#### Encapsulation
-
-Instrumentation should be encapsulated within a dedicated `struct` (e.g. `instrumentation`).
-It should not be mixed into the instrumented component.
-
-Prefer this:
-
-```go
-type SDKComponent struct {
-    inst *instrumentation
-}
-
-type instrumentation struct {
-	inflight otelconv.SDKComponentInflight
-	exported otelconv.SDKComponentExported
-}
-```
-
-To this:
-
-```go
-// ❌ Avoid this pattern.
-type SDKComponent struct {
-	/* other SDKComponent fields... */
-
-	inflight otelconv.SDKComponentInflight
-	exported otelconv.SDKComponentExported
-}
-```
-
-The instrumentation code should not bloat the code being instrumented.
-Likely, this means its own file, or its own package if it is complex or reused.
-
-#### Initialization
-
-Instrumentation setup should be explicit, side-effect free, and local to the relevant component.
-Avoid relying on global or implicit [side effects][side-effect] for initialization.
-
-Encapsulate setup in constructor functions, ensuring clear ownership and scope:
-
-```go
-import (
-	"errors"
-
-	semconv "go.opentelemetry.io/otel/semconv/v1.39.0"
-	"go.opentelemetry.io/otel/semconv/v1.39.0/otelconv"
-)
-
-type SDKComponent struct {
-    inst *instrumentation
-}
-
-func NewSDKComponent(config Config) (*SDKComponent, error) {
-    inst, err := newInstrumentation()
-    if err != nil {
-        return nil, err
-    }
-    return &SDKComponent{inst: inst}, nil
-}
-
-type instrumentation struct {
-    inflight otelconv.SDKComponentInflight
-    exported otelconv.SDKComponentExported
-}
-
-func newInstrumentation() (*instrumentation, error) {
-    if !x.Observability.Enabled() {
-        return nil, nil
-    }
- 
-    meter := otel.GetMeterProvider().Meter(
-        "<component-package-name>",
-        metric.WithInstrumentationVersion(sdk.Version()),
-        metric.WithSchemaURL(semconv.SchemaURL),
-    )
-
-	inst := &instrumentation{}
-
-	var err, e error
-    inst.inflight, e = otelconv.NewSDKComponentInflight(meter)
-	err = errors.Join(err, e)
-
-    inst.exported, e = otelconv.NewSDKComponentExported(meter)
-	err = errors.Join(err, e)
-
-    return inst, err
-}
-```
-
-```go
-// ❌ Avoid this pattern.
-func (c *Component) initObservability() {
-	// Initialize observability metrics
-	if !x.Observability.Enabled() {
-		return
-	}
-
-	// Initialize observability metrics
-	c.inst = &instrumentation{/* ... */}
-}
-```
-
-[side-effect]: https://en.wikipedia.org/wiki/Side_effect_(computer_science)
-
-#### Performance
-
-When observability is disabled there should be little to no overhead.
-
-```go
-func (e *Exporter) ExportSpans(ctx context.Context, spans []trace.ReadOnlySpan) error {
-	if e.inst != nil {
-		attrs := expensiveOperation()
-		e.inst.recordSpanInflight(ctx, int64(len(spans)), attrs...)
-	}
-    // Export spans...
-}
-```
-
-```go
-// ❌ Avoid this pattern.
-func (e *Exporter) ExportSpans(ctx context.Context, spans []trace.ReadOnlySpan) error {
-	attrs := expensiveOperation()
-	e.inst.recordSpanInflight(ctx, int64(len(spans)), attrs...)
-    // Export spans...
-}
-
-func (i *instrumentation) recordSpanInflight(ctx context.Context, count int64, attrs ...attribute.KeyValue) {
-	if i == nil || i.inflight == nil {
-		return
-	}
-	i.inflight.Add(ctx, count, metric.WithAttributes(attrs...))
-}
-```
-
-When observability is enabled, the instrumentation code paths should be optimized to reduce allocation and computation overhead.
-
-##### Attribute and Option Allocation Management
-
-Pool attribute slices and options with [`sync.Pool`] to minimize allocations in measurement calls with dynamic attributes.
-
-```go
-var (
-	attrPool = sync.Pool{
-        New: func() any {
-		    // Pre-allocate common capacity
-    		knownCap := 8 // Adjust based on expected usage
-            s := make([]attribute.KeyValue, 0, knownCap)
-    		// Return a pointer to avoid extra allocation on Put().
-            return &s
-        },
-    }
-
-	addOptPool = &sync.Pool{
-		New: func() any {
-			const n = 1 // WithAttributeSet
-			o := make([]metric.AddOption, 0, n)
-    		// Return a pointer to avoid extra allocation on Put().
-			return &o
-		},
-	}
-)
-
-func (i *instrumentation) record(ctx context.Context, value int64, baseAttrs ...attribute.KeyValue) {
-    attrs := attrPool.Get().(*[]attribute.KeyValue)
-    defer func() {
-        *attrs = (*attrs)[:0] // Reset.
-        attrPool.Put(attrs)
-    }()
-
-    *attrs = append(*attrs, baseAttrs...)
-    // Add any dynamic attributes.
-    *attrs = append(*attrs, semconv.OTelComponentName("exporter-1"))
-
-	addOpt := addOptPool.Get().(*[]metric.AddOption)
-	defer func() {
-		*addOpt = (*addOpt)[:0]
-		addOptPool.Put(addOpt)
-	}()
-
-	set := attribute.NewSet(*attrs...)
-	*addOpt = append(*addOpt, metric.WithAttributeSet(set))
-
-    i.counter.Add(ctx, value, *addOpt...)
-}
-```
-
-Pools are most effective when there are many pooled objects of the same sufficiently large size, and the objects are repeatedly used.
-This amortizes the cost of allocation and synchronization.
-Ideally, the pools should be scoped to be used as widely as possible within the component to maximize this efficiency while still ensuring correctness.
-
-[`sync.Pool`]: https://pkg.go.dev/sync#Pool
-
-##### Cache common attribute sets for repeated measurements
-
-If a static set of attributes are used for measurements and they are known at compile time, pre-compute and cache these attributes.
-
-```go
-type spanLiveSetKey struct {
-	sampled bool
-}
-
-var spanLiveSetCache = map[spanLiveSetKey]attribute.Set{
-	{true}: attribute.NewSet(
-		otelconv.SDKSpanLive{}.AttrSpanSamplingResult(
-			otelconv.SpanSamplingResultRecordAndSample,
-		),
-	),
-	{false}: attribute.NewSet(
-		otelconv.SDKSpanLive{}.AttrSpanSamplingResult(
-			otelconv.SpanSamplingResultRecordOnly,
-		),
-	),
-}
-
-func spanLiveSet(sampled bool) attribute.Set {
-	key := spanLiveSetKey{sampled: sampled}
-	return spanLiveSetCache[key]
-}
-```
-
-##### Benchmarking
-
-Always provide benchmarks when introducing or refactoring instrumentation.
-Demonstrate the impact (allocs/op, B/op, ns/op) in enabled/disabled scenarios:
-
-```go
-func BenchmarkExportSpans(b *testing.B) {
-    scenarios := []struct {
-        name           string
-        obsEnabled bool
-    }{
-        {"ObsDisabled", false},
-        {"ObsEnabled", true},
-    }
- 
-    for _, scenario := range scenarios {
-        b.Run(scenario.name, func(b *testing.B) {
-            b.Setenv(
-				"OTEL_GO_X_OBSERVABILITY",
-				strconv.FormatBool(scenario.obsEnabled),
-			)
-
-            exporter := NewExporter()
-            spans := generateTestSpans(100)
-
-            b.ResetTimer()
-            b.ReportAllocs()
-
-            for i := 0; i < b.N; i++ {
-                _ = exporter.ExportSpans(context.Background(), spans)
-            }
-        })
-    }
-}
-```
-
-#### Error Handling and Robustness
-
-Errors should be reported back to the caller if possible, and partial failures should be handled as gracefully as possible.
-
-```go
-func newInstrumentation() (*instrumentation, error) {
-    if !x.Observability.Enabled() {
-        return nil, nil
-    }
- 
-    m := otel.GetMeterProvider().Meter(/* initialize meter */)
-    counter, err := otelconv.NewSDKComponentCounter(m)
-	// Use the partially initialized counter if available.
-	i := &instrumentation{counter: counter}
-	// Return any error to the caller.
-    return i, err
-}
-```
-
-```go
-// ❌ Avoid this pattern.
-func newInstrumentation() *instrumentation {
-    if !x.Observability.Enabled() {
-        return nil, nil
-    }
- 
-    m := otel.GetMeterProvider().Meter(/* initialize meter */)
-    counter, err := otelconv.NewSDKComponentCounter(m)
-	if err != nil {
-		// ❌ Do not dump the error to the OTel Handler. Return it to the
-		// caller.
-		otel.Handle(err)
-		// ❌ Do not return nil if we can still use the partially initialized
-		// counter.
-		return nil
-	}
-    return &instrumentation{counter: counter}
-}
-```
-
-If the instrumented component cannot report the error to the user, let it report the error to `otel.Handle`.
-
-#### Context Propagation
-
-Ensure observability measurements receive the correct context, especially for trace exemplars and distributed context:
-
-```go
-func (e *Exporter) ExportSpans(ctx context.Context, spans []trace.ReadOnlySpan) error {
-    // Use the provided context for observability measurements
-    e.inst.recordSpanExportStarted(ctx, len(spans))
- 
-    err := e.doExport(ctx, spans)
-
-    if err != nil {
-        e.inst.recordSpanExportFailed(ctx, len(spans), err)
-    } else {
-        e.inst.recordSpanExportSucceeded(ctx, len(spans))
-    }
- 
-    return err
-}
-```
-
-```go
-// ❌ Avoid this pattern.
-func (e *Exporter) ExportSpans(ctx context.Context, spans []trace.ReadOnlySpan) error {
-    // ❌ Do not break the context propagation.
-    e.inst.recordSpanExportStarted(context.Background(), len(spans))
- 
-    err := e.doExport(ctx, spans)
-
-	/* ... */
- 
-    return err
-}
-```
-
-#### Semantic Conventions Compliance
-
-All observability metrics should follow the [OpenTelemetry Semantic Conventions for SDK metrics](https://github.com/open-telemetry/semantic-conventions/blob/1cf2476ae5e518225a766990a28a6d5602bd5a30/docs/otel/sdk-metrics.md).
-
-Use the metric semantic conventions convenience package [otelconv](./semconv/v1.39.0/otelconv/metric.go).
-
-##### Component Identification
-
-Component names and types should follow [semantic convention](https://github.com/open-telemetry/semantic-conventions/blob/1cf2476ae5e518225a766990a28a6d5602bd5a30/docs/registry/attributes/otel.md#otel-component-attributes).
-
-If a component is not a well-known type specified in the semantic conventions, use the package path scope type as a stable identifier.
-
-```go
-componentType := "go.opentelemetry.io/otel/sdk/trace.Span"
-```
-
-```go
-// ❌ Do not do this.
-componentType := "trace-span"
-```
-
-The component name should be a stable unique identifier for the specific instance of the component.
-
-Use a global counter to ensure uniqueness if necessary.
-
-```go
-// Unique 0-based ID counter for component instances.
-var componentIDCounter atomic.Int64
-
-// nextID returns the next unique ID for a component.
-func nextID() int64 {
-	return componentIDCounter.Add(1) - 1
-}
-
-// componentName returns a unique name for the component instance.
-func componentName() attribute.KeyValue {
-	id := nextID()
-	name := fmt.Sprintf("%s/%d", componentType, id)
-	return semconv.OTelComponentName(name)
-}
-```
-
-The component ID will need to be resettable for deterministic testing.
-If tests are in a different package than the component being tested (i.e. a `<component package>_test` package name), use a generated `counter` internal package to manage the counter.
-See [stdouttrace exporter example](./exporters/stdout/stdouttrace/internal/gen.go) for reference.
-
-#### Testing
-
-Use deterministic testing with isolated state:
-
-```go
-func TestObservability(t *testing.T) {
-	// Restore state after test to ensure this does not affect other tests.
-    prev := otel.GetMeterProvider()
-    t.Cleanup(func() { otel.SetMeterProvider(prev) })
-
-    // Isolate the meter provider for deterministic testing
-    reader := metric.NewManualReader()
-    meterProvider := metric.NewMeterProvider(metric.WithReader(reader))
-    otel.SetMeterProvider(meterProvider)
-
-	// Use t.Setenv to ensure environment variable is restored after test.
-    t.Setenv("OTEL_GO_X_OBSERVABILITY", "true")
-
-	// Reset component ID counter to ensure deterministic component names.
-	componentIDCounter.Store(0)
- 
-	/* ... test code ... */
-}
-```
-
-Test order should not affect results.
-Ensure that any global state (e.g. component ID counters) is reset between tests.
-
 ## Approvers and Maintainers
 
-### Maintainers
-
-- [Damien Mathieu](https://github.com/dmathieu), Elastic ([GPG](https://keys.openpgp.org/search?q=5A126B972A81A6CE443E5E1B408B8E44F0873832))
-- [David Ashpole](https://github.com/dashpole), Google ([GPG](https://keys.openpgp.org/search?q=C0D1BDDCAAEAE573673085F176327DA4D864DC70))
-- [Robert Pająk](https://github.com/pellared), Splunk ([GPG](https://keys.openpgp.org/search?q=CDAD3A60476A3DE599AA5092E5F7C35A4DBE90C2))
-- [Sam Xie](https://github.com/XSAM), Splunk ([GPG](https://keys.openpgp.org/search?q=AEA033782371ABB18EE39188B8044925D6FEEBEA))
-- [Tyler Yahn](https://github.com/MrAlias), Splunk ([GPG](https://keys.openpgp.org/search?q=0x46B0F3E1A8B1BA5A))
-
-For more information about the maintainer role, see the [community repository](https://github.com/open-telemetry/community/blob/main/guides/contributor/membership.md#maintainer).
-
-### Approvers
-
-- [Flc](https://github.com/flc1125), Independent
-
-For more information about the approver role, see the [community repository](https://github.com/open-telemetry/community/blob/main/guides/contributor/membership.md#approver).
-
 ### Triagers
 
-- [Alex Kats](https://github.com/akats7), Capital One
+- [Cheng-Zhen Yang](https://github.com/scorpionknifes), Independent
 
-For more information about the triager role, see the [community repository](https://github.com/open-telemetry/community/blob/main/guides/contributor/membership.md#triager).
+### Approvers
+
+### Maintainers
+
+- [Damien Mathieu](https://github.com/dmathieu), Elastic
+- [David Ashpole](https://github.com/dashpole), Google
+- [Robert Pająk](https://github.com/pellared), Splunk
+- [Sam Xie](https://github.com/XSAM), Cisco/AppDynamics
+- [Tyler Yahn](https://github.com/MrAlias), Splunk
 
 ### Emeritus
 
 - [Aaron Clawson](https://github.com/MadVikingGod)
 - [Anthony Mirabella](https://github.com/Aneurysm9)
-- [Cheng-Zhen Yang](https://github.com/scorpionknifes)
 - [Chester Cheung](https://github.com/hanyuancheung)
 - [Evan Torrie](https://github.com/evantorrie)
 - [Gustavo Silva Paiva](https://github.com/paivagustavo)
 - [Josh MacDonald](https://github.com/jmacd)
 - [Liz Fong-Jones](https://github.com/lizthegrey)
 
-For more information about the emeritus role, see the [community repository](https://github.com/open-telemetry/community/blob/main/guides/contributor/membership.md#emeritus-maintainerapprovertriager).
-
 ### Become an Approver or a Maintainer
 
 See the [community membership document in OpenTelemetry community

src/runtime/vendor/go.opentelemetry.io/otel/LICENSE

@@ -199,33 +199,3 @@
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
    limitations under the License.
-
---------------------------------------------------------------------------------
-
-Copyright 2009 The Go Authors.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are
-met:
-
-   * Redistributions of source code must retain the above copyright
-notice, this list of conditions and the following disclaimer.
-   * Redistributions in binary form must reproduce the above
-copyright notice, this list of conditions and the following disclaimer
-in the documentation and/or other materials provided with the
-distribution.
-   * Neither the name of Google LLC nor the names of its
-contributors may be used to endorse or promote products derived from
-this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

src/runtime/vendor/go.opentelemetry.io/otel/Makefile

@@ -34,17 +34,17 @@ $(TOOLS)/%: $(TOOLS_MOD_DIR)/go.mod | $(TOOLS)
 MULTIMOD = $(TOOLS)/multimod
 $(TOOLS)/multimod: PACKAGE=go.opentelemetry.io/build-tools/multimod
 
+SEMCONVGEN = $(TOOLS)/semconvgen
+$(TOOLS)/semconvgen: PACKAGE=go.opentelemetry.io/build-tools/semconvgen
+
 CROSSLINK = $(TOOLS)/crosslink
 $(TOOLS)/crosslink: PACKAGE=go.opentelemetry.io/build-tools/crosslink
 
 SEMCONVKIT = $(TOOLS)/semconvkit
 $(TOOLS)/semconvkit: PACKAGE=go.opentelemetry.io/otel/$(TOOLS_MOD_DIR)/semconvkit
 
-VERIFYREADMES = $(TOOLS)/verifyreadmes
-$(TOOLS)/verifyreadmes: PACKAGE=go.opentelemetry.io/otel/$(TOOLS_MOD_DIR)/verifyreadmes
-
 GOLANGCI_LINT = $(TOOLS)/golangci-lint
-$(TOOLS)/golangci-lint: PACKAGE=github.com/golangci/golangci-lint/v2/cmd/golangci-lint
+$(TOOLS)/golangci-lint: PACKAGE=github.com/golangci/golangci-lint/cmd/golangci-lint
 
 MISSPELL = $(TOOLS)/misspell
 $(TOOLS)/misspell: PACKAGE=github.com/client9/misspell/cmd/misspell
@@ -68,7 +68,7 @@ GOVULNCHECK = $(TOOLS)/govulncheck
 $(TOOLS)/govulncheck: PACKAGE=golang.org/x/vuln/cmd/govulncheck
 
 .PHONY: tools
-tools: $(CROSSLINK) $(GOLANGCI_LINT) $(MISSPELL) $(GOCOVMERGE) $(STRINGER) $(PORTO) $(VERIFYREADMES) $(MULTIMOD) $(SEMCONVKIT) $(GOTMPL) $(GORELEASE)
+tools: $(CROSSLINK) $(GOLANGCI_LINT) $(MISSPELL) $(GOCOVMERGE) $(STRINGER) $(PORTO) $(SEMCONVGEN) $(MULTIMOD) $(SEMCONVKIT) $(GOTMPL) $(GORELEASE)
 
 # Virtualized python tools via docker
 
@@ -146,12 +146,11 @@ build-tests/%:
 
 # Tests
 
-TEST_TARGETS := test-default test-bench test-short test-verbose test-race test-concurrent-safe test-fuzz
+TEST_TARGETS := test-default test-bench test-short test-verbose test-race test-concurrent-safe
 .PHONY: $(TEST_TARGETS) test
 test-default test-race: ARGS=-race
 test-bench:   ARGS=-run=xxxxxMatchNothingxxxxx -test.benchtime=1ms -bench=.
 test-short:   ARGS=-short
-test-fuzz:    ARGS=-fuzztime=10s -fuzz
 test-verbose: ARGS=-v -race
 test-concurrent-safe: ARGS=-run=ConcurrentSafe -count=100 -race
 test-concurrent-safe: TIMEOUT=120
@@ -214,8 +213,11 @@ go-mod-tidy/%: crosslink
 		&& cd $(DIR) \
 		&& $(GO) mod tidy -compat=1.21
 
+.PHONY: lint-modules
+lint-modules: go-mod-tidy
+
 .PHONY: lint
-lint: misspell go-mod-tidy golangci-lint govulncheck
+lint: misspell lint-modules golangci-lint govulncheck
 
 .PHONY: vanity-import-check
 vanity-import-check: $(PORTO)
@@ -282,7 +284,7 @@ semconv-generate: $(SEMCONVKIT)
 	docker run --rm \
 		-u $(DOCKER_USER) \
 		--env HOME=/tmp/weaver \
-		--mount 'type=bind,source=$(PWD)/semconv/templates,target=/home/weaver/templates,readonly' \
+		--mount 'type=bind,source=$(PWD)/semconv,target=/home/weaver/templates/registry/go,readonly' \
 		--mount 'type=bind,source=$(PWD)/semconv/${TAG},target=/home/weaver/target' \
 		--mount 'type=bind,source=$(HOME)/.weaver,target=/tmp/weaver/.weaver' \
 		$(WEAVER_IMAGE) registry generate \
@@ -291,7 +293,7 @@ semconv-generate: $(SEMCONVKIT)
 		--param tag=$(TAG) \
 		go \
 		/home/weaver/target
-	$(SEMCONVKIT) -semconv "$(SEMCONVPKG)" -tag "$(TAG)"
+	$(SEMCONVKIT) -output "$(SEMCONVPKG)/$(TAG)" -tag "$(TAG)"
 
 .PHONY: gorelease
 gorelease: $(OTEL_GO_MOD_DIRS:%=gorelease/%)
@@ -317,11 +319,10 @@ add-tags: verify-mods
 	@[ "${MODSET}" ] || ( echo ">> env var MODSET is not set"; exit 1 )
 	$(MULTIMOD) tag -m ${MODSET} -c ${COMMIT}
 
-MARKDOWNIMAGE := $(shell awk '$$4=="markdown" {print $$2}' $(DEPENDENCIES_DOCKERFILE))
 .PHONY: lint-markdown
 lint-markdown:
-	docker run --rm -u $(DOCKER_USER) -v "$(CURDIR):$(WORKDIR)" $(MARKDOWNIMAGE) -c $(WORKDIR)/.markdownlint.yaml $(WORKDIR)/**/*.md
+	docker run -v "$(CURDIR):$(WORKDIR)" avtodev/markdown-lint:v1 -c $(WORKDIR)/.markdownlint.yaml $(WORKDIR)/**/*.md
 
 .PHONY: verify-readmes
-verify-readmes: $(VERIFYREADMES)
-	$(VERIFYREADMES)
+verify-readmes:
+	./verify_readmes.sh

src/runtime/vendor/go.opentelemetry.io/otel/README.md

@@ -6,8 +6,6 @@
 [![Go Report Card](https://goreportcard.com/badge/go.opentelemetry.io/otel)](https://goreportcard.com/report/go.opentelemetry.io/otel)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/open-telemetry/opentelemetry-go/badge)](https://scorecard.dev/viewer/?uri=github.com/open-telemetry/opentelemetry-go)
 [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/9996/badge)](https://www.bestpractices.dev/projects/9996)
-[![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/opentelemetry-go.svg)](https://issues.oss-fuzz.com/issues?q=project:opentelemetry-go)
-[![FOSSA Status](https://app.fossa.com/api/projects/custom%2B162%2Fgithub.com%2Fopen-telemetry%2Fopentelemetry-go.svg?type=shield&issueType=license)](https://app.fossa.com/projects/custom%2B162%2Fgithub.com%2Fopen-telemetry%2Fopentelemetry-go?ref=badge_shield&issueType=license)
 [![Slack](https://img.shields.io/badge/slack-@cncf/otel--go-brightgreen.svg?logo=slack)](https://cloud-native.slack.com/archives/C01NPAXACKT)
 
 OpenTelemetry-Go is the [Go](https://golang.org/) implementation of [OpenTelemetry](https://opentelemetry.io/).
@@ -53,20 +51,27 @@ Currently, this project supports the following environments.
 
 | OS       | Go Version | Architecture |
 |----------|------------|--------------|
-| Ubuntu   | 1.25       | amd64        |
 | Ubuntu   | 1.24       | amd64        |
-| Ubuntu   | 1.25       | 386          |
+| Ubuntu   | 1.23       | amd64        |
+| Ubuntu   | 1.22       | amd64        |
 | Ubuntu   | 1.24       | 386          |
-| Ubuntu   | 1.25       | arm64        |
+| Ubuntu   | 1.23       | 386          |
+| Ubuntu   | 1.22       | 386          |
 | Ubuntu   | 1.24       | arm64        |
-| macOS    | 1.25       | amd64        |
-| macOS    | 1.24       | amd64        |
-| macOS    | 1.25       | arm64        |
+| Ubuntu   | 1.23       | arm64        |
+| Ubuntu   | 1.22       | arm64        |
+| macOS 13 | 1.24       | amd64        |
+| macOS 13 | 1.23       | amd64        |
+| macOS 13 | 1.22       | amd64        |
 | macOS    | 1.24       | arm64        |
-| Windows  | 1.25       | amd64        |
+| macOS    | 1.23       | arm64        |
+| macOS    | 1.22       | arm64        |
 | Windows  | 1.24       | amd64        |
-| Windows  | 1.25       | 386          |
+| Windows  | 1.23       | amd64        |
+| Windows  | 1.22       | amd64        |
 | Windows  | 1.24       | 386          |
+| Windows  | 1.23       | 386          |
+| Windows  | 1.22       | 386          |
 
 While this project should work for other systems, no compatibility guarantees
 are made for those systems currently.

src/runtime/vendor/go.opentelemetry.io/otel/RELEASING.md

@@ -1,9 +1,5 @@
 # Release Process
 
-## Create a `Version Release` issue
-
-Create a `Version Release` issue to track the release process.
-
 ## Semantic Convention Generation
 
 New versions of the [OpenTelemetry Semantic Conventions] mean new versions of the `semconv` package need to be generated.
@@ -24,7 +20,7 @@ Ensure things look correct before submitting a pull request to include the addit
 
 ## Breaking changes validation
 
-You can run `make gorelease` which runs [gorelease](https://pkg.go.dev/golang.org/x/exp/cmd/gorelease) to ensure that there are no unwanted changes made in the public API.
+You can run `make gorelease` that runs [gorelease](https://pkg.go.dev/golang.org/x/exp/cmd/gorelease) to ensure that there are no unwanted changes done in the public API.
 
 You can check/report problems with `gorelease` [here](https://golang.org/issues/26420).
 
@@ -62,7 +58,7 @@ Update go.mod for submodules to depend on the new release which will happen in t
     ```
 
 3. Update the [Changelog](./CHANGELOG.md).
-   - Make sure all relevant changes for this release are included and are written in language that non-contributors to the project can understand.
+   - Make sure all relevant changes for this release are included and are in language that non-contributors to the project can understand.
        To verify this, you can look directly at the commits since the `<last tag>`.
 
        ```
@@ -107,50 +103,11 @@ It is critical you make sure the version you push upstream is correct.
     ...
     ```
 
-## Sign artifacts
-
-To ensure we comply with CNCF best practices, we need to sign the release artifacts.
-
-Download the `.tar.gz` and `.zip` archives from the [tags page](https://github.com/open-telemetry/opentelemetry-go/tags) for the new release tag.
-Both archives need to be signed with your GPG key.
-
-You can use [this script] to verify the contents of the archives before signing them.
-
-To find your GPG key ID, run:
-
-```terminal
-gpg --list-secret-keys --keyid-format=long
-```
-
-The key ID is the 16-character string after `sec rsa4096/` (or similar).
-
-Set environment variables and sign both artifacts:
-
-```terminal
-export VERSION="<version>"  # e.g., v1.32.0
-export KEY_ID="<your-gpg-key-id>"
-
-gpg --local-user $KEY_ID --armor --detach-sign opentelemetry-go-$VERSION.tar.gz
-gpg --local-user $KEY_ID --armor --detach-sign opentelemetry-go-$VERSION.zip
-```
-
-You can verify the signatures with:
-
-```terminal
-gpg --verify opentelemetry-go-$VERSION.tar.gz.asc opentelemetry-go-$VERSION.tar.gz
-gpg --verify opentelemetry-go-$VERSION.zip.asc opentelemetry-go-$VERSION.zip
-```
-
-[this script]: https://github.com/MrAlias/attest-sh
-
 ## Release
 
 Finally create a Release for the new `<new tag>` on GitHub.
 The release body should include all the release notes from the Changelog for this release.
 
-***IMPORTANT***: GitHub Releases are immutable once created.
-You must upload the signed artifacts (`.tar.gz`, `.tar.gz.asc`, `.zip`, and `.zip.asc`) when creating the release, as they cannot be added or modified later.
-
 ## Post-Release
 
 ### Contrib Repository
@@ -166,16 +123,10 @@ Importantly, bump any package versions referenced to be the latest one you just
 [Go instrumentation documentation]: https://opentelemetry.io/docs/languages/go/
 [content/en/docs/languages/go]: https://github.com/open-telemetry/opentelemetry.io/tree/main/content/en/docs/languages/go
 
-### Close the milestone
+### Demo Repository
 
-Once a release is made, ensure all issues that were fixed and PRs that were merged as part of this release are added to the corresponding milestone.
-This helps track what changes were included in each release.
+Bump the dependencies in the following Go services:
 
-- To find issues that haven't been included in a milestone, use this [GitHub search query](https://github.com/open-telemetry/opentelemetry-go/issues?q=is%3Aissue%20no%3Amilestone%20is%3Aclosed%20sort%3Aupdated-desc%20reason%3Acompleted%20-label%3AStale%20linked%3Apr)
-- To find merged PRs that haven't been included in a milestone, use this [GitHub search query](https://github.com/open-telemetry/opentelemetry-go/pulls?q=is%3Apr+no%3Amilestone+is%3Amerged).
-
-Once all related issues and PRs have been added to the milestone, close the milestone.
-
-### Close the `Version Release` issue
-
-Once the todo list in the `Version Release` issue is complete, close the issue.
+- [`accounting`](https://github.com/open-telemetry/opentelemetry-demo/tree/main/src/accounting)
+- [`checkoutservice`](https://github.com/open-telemetry/opentelemetry-demo/tree/main/src/checkout)
+- [`productcatalogservice`](https://github.com/open-telemetry/opentelemetry-demo/tree/main/src/product-catalog)

src/runtime/vendor/go.opentelemetry.io/otel/SECURITY-INSIGHTS.yml

@@ -1,203 +0,0 @@
-header:
-  schema-version: "1.0.0"
-  expiration-date: "2026-08-04T00:00:00.000Z"
-  last-updated: "2025-08-04"
-  last-reviewed: "2025-08-04"
-  commit-hash: 69e81088ad40f45a0764597326722dea8f3f00a8
-  project-url: https://github.com/open-telemetry/opentelemetry-go
-  project-release: "v1.37.0"
-  changelog: https://github.com/open-telemetry/opentelemetry-go/blob/69e81088ad40f45a0764597326722dea8f3f00a8/CHANGELOG.md
-  license: https://github.com/open-telemetry/opentelemetry-go/blob/69e81088ad40f45a0764597326722dea8f3f00a8/LICENSE
-
-project-lifecycle:
-  status: active
-  bug-fixes-only: false
-  core-maintainers:
-    - https://github.com/dmathieu
-    - https://github.com/dashpole
-    - https://github.com/pellared
-    - https://github.com/XSAM
-    - https://github.com/MrAlias
-  release-process: |
-    See https://github.com/open-telemetry/opentelemetry-go/blob/69e81088ad40f45a0764597326722dea8f3f00a8/RELEASING.md
-
-contribution-policy:
-  accepts-pull-requests: true
-  accepts-automated-pull-requests: true
-  automated-tools-list:
-    - automated-tool: dependabot
-      action: allowed
-      comment: Automated dependency updates are accepted.
-    - automated-tool: renovatebot
-      action: allowed
-      comment: Automated dependency updates are accepted.
-    - automated-tool: opentelemetrybot
-      action: allowed
-      comment: Automated OpenTelemetry actions are accepted.
-  contributing-policy: https://github.com/open-telemetry/opentelemetry-go/blob/69e81088ad40f45a0764597326722dea8f3f00a8/CONTRIBUTING.md
-  code-of-conduct: https://github.com/open-telemetry/.github/blob/ffa15f76b65ec7bcc41f6a0b277edbb74f832206/CODE_OF_CONDUCT.md
-
-documentation:
-  - https://pkg.go.dev/go.opentelemetry.io/otel
-  - https://opentelemetry.io/docs/instrumentation/go/
-
-distribution-points:
-  - pkg:golang/go.opentelemetry.io/otel
-  - pkg:golang/go.opentelemetry.io/otel/bridge/opencensus
-  - pkg:golang/go.opentelemetry.io/otel/bridge/opencensus/test
-  - pkg:golang/go.opentelemetry.io/otel/bridge/opentracing
-  - pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc
-  - pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
-  - pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace
-  - pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
-  - pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
-  - pkg:golang/go.opentelemetry.io/otel/exporters/stdout/stdoutmetric
-  - pkg:golang/go.opentelemetry.io/otel/exporters/stdout/stdouttrace
-  - pkg:golang/go.opentelemetry.io/otel/exporters/zipkin
-  - pkg:golang/go.opentelemetry.io/otel/metric
-  - pkg:golang/go.opentelemetry.io/otel/sdk
-  - pkg:golang/go.opentelemetry.io/otel/sdk/metric
-  - pkg:golang/go.opentelemetry.io/otel/trace
-  - pkg:golang/go.opentelemetry.io/otel/exporters/prometheus
-  - pkg:golang/go.opentelemetry.io/otel/log
-  - pkg:golang/go.opentelemetry.io/otel/log/logtest
-  - pkg:golang/go.opentelemetry.io/otel/sdk/log
-  - pkg:golang/go.opentelemetry.io/otel/sdk/log/logtest
-  - pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc
-  - pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp
-  - pkg:golang/go.opentelemetry.io/otel/exporters/stdout/stdoutlog
-  - pkg:golang/go.opentelemetry.io/otel/schema
-
-security-artifacts:
-  threat-model:
-    threat-model-created: false
-    comment: |
-      No formal threat model created yet.
-  self-assessment:
-    self-assessment-created: false
-    comment: |
-      No formal self-assessment yet.
-
-security-testing:
-  - tool-type: sca
-    tool-name: Dependabot
-    tool-version: latest
-    tool-url: https://github.com/dependabot
-    tool-rulesets:
-      - built-in
-    integration:
-      ad-hoc: false
-      ci: true
-      before-release: true
-    comment: |
-      Automated dependency updates.
-  - tool-type: sast
-    tool-name: golangci-lint
-    tool-version: latest
-    tool-url: https://github.com/golangci/golangci-lint
-    tool-rulesets:
-      - built-in
-    integration:
-      ad-hoc: false
-      ci: true
-      before-release: true
-    comment: |
-      Static analysis in CI.
-  - tool-type: fuzzing
-    tool-name: OSS-Fuzz
-    tool-version: latest
-    tool-url: https://github.com/google/oss-fuzz
-    tool-rulesets:
-      - default
-    integration:
-      ad-hoc: false
-      ci: false
-      before-release: false
-    comment: |
-      OpenTelemetry Go is integrated with OSS-Fuzz for continuous fuzz testing. See https://github.com/google/oss-fuzz/tree/f0f9b221190c6063a773bea606d192ebfc3d00cf/projects/opentelemetry-go for more details.
-  - tool-type: sast
-    tool-name: CodeQL
-    tool-version: latest
-    tool-url: https://github.com/github/codeql
-    tool-rulesets:
-      - default
-    integration:
-      ad-hoc: false
-      ci: true
-      before-release: true
-    comment: |
-      CodeQL static analysis is run in CI for all commits and pull requests to detect security vulnerabilities in the Go source code. See https://github.com/open-telemetry/opentelemetry-go/blob/d5b5b059849720144a03ca5c87561bfbdb940119/.github/workflows/codeql-analysis.yml for workflow details.
-  - tool-type: sca
-    tool-name: govulncheck
-    tool-version: latest
-    tool-url: https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck
-    tool-rulesets:
-      - default
-    integration:
-      ad-hoc: false
-      ci: true
-      before-release: true
-    comment: |
-      govulncheck is run in CI to detect known vulnerabilities in Go modules and code paths. See https://github.com/open-telemetry/opentelemetry-go/blob/v1.37.0/.github/workflows/ci.yml for workflow configuration.
-
-security-assessments:
-  - auditor-name: 7ASecurity
-    auditor-url: https://7asecurity.com
-    auditor-report: https://7asecurity.com/reports/pentest-report-opentelemetry.pdf
-    report-year: 2023
-    comment: |
-      This independent penetration test by 7ASecurity covered OpenTelemetry repositories including opentelemetry-go. The assessment focused on codebase review, threat modeling, and vulnerability identification. See the report for details of findings and recommendations applicable to opentelemetry-go. No critical vulnerabilities were found for this repository.
-
-security-contacts:
-  - type: email
-    value: cncf-opentelemetry-security@lists.cncf.io
-    primary: true
-  - type: website
-    value: https://github.com/open-telemetry/opentelemetry-go/security/policy
-    primary: false
-
-vulnerability-reporting:
-  accepts-vulnerability-reports: true
-  email-contact: cncf-opentelemetry-security@lists.cncf.io
-  security-policy: https://github.com/open-telemetry/opentelemetry-go/security/policy
-  comment: |
-    Security issues should be reported via email or GitHub security policy page.
-
-dependencies:
-  third-party-packages: true
-  dependencies-lists:
-    - https://github.com/open-telemetry/opentelemetry-go/blob/v1.37.0/go.mod
-    - https://github.com/open-telemetry/opentelemetry-go/blob/v1.37.0/bridge/opencensus/go.mod
-    - https://github.com/open-telemetry/opentelemetry-go/blob/v1.37.0/bridge/opencensus/test/go.mod
-    - https://github.com/open-telemetry/opentelemetry-go/blob/v1.37.0/bridge/opentracing/go.mod
-    - https://github.com/open-telemetry/opentelemetry-go/blob/v1.37.0/exporters/otlp/otlplog/otlploggrpc/go.mod
-    - https://github.com/open-telemetry/opentelemetry-go/blob/v1.37.0/exporters/otlp/otlplog/otlploghttp/go.mod
-    - https://github.com/open-telemetry/opentelemetry-go/blob/v1.37.0/exporters/otlp/otlpmetric/otlpmetricgrpc/go.mod
-    - https://github.com/open-telemetry/opentelemetry-go/blob/v1.37.0/exporters/otlp/otlpmetric/otlpmetrichttp/go.mod
-    - https://github.com/open-telemetry/opentelemetry-go/blob/v1.37.0/exporters/otlp/otlptrace/go.mod
-    - https://github.com/open-telemetry/opentelemetry-go/blob/v1.37.0/exporters/otlp/otlptrace/otlptracegrpc/go.mod
-    - https://github.com/open-telemetry/opentelemetry-go/blob/v1.37.0/exporters/otlp/otlptrace/otlptracehttp/go.mod
-    - https://github.com/open-telemetry/opentelemetry-go/blob/v1.37.0/exporters/prometheus/go.mod
-    - https://github.com/open-telemetry/opentelemetry-go/blob/v1.37.0/exporters/stdout/stdoutlog/go.mod
-    - https://github.com/open-telemetry/opentelemetry-go/blob/v1.37.0/exporters/stdout/stdoutmetric/go.mod
-    - https://github.com/open-telemetry/opentelemetry-go/blob/v1.37.0/exporters/stdout/stdouttrace/go.mod
-    - https://github.com/open-telemetry/opentelemetry-go/blob/v1.37.0/exporters/zipkin/go.mod
-    - https://github.com/open-telemetry/opentelemetry-go/blob/v1.37.0/internal/tools/go.mod
-    - https://github.com/open-telemetry/opentelemetry-go/blob/v1.37.0/log/go.mod
-    - https://github.com/open-telemetry/opentelemetry-go/blob/v1.37.0/log/logtest/go.mod
-    - https://github.com/open-telemetry/opentelemetry-go/blob/v1.37.0/metric/go.mod
-    - https://github.com/open-telemetry/opentelemetry-go/blob/v1.37.0/schema/go.mod
-    - https://github.com/open-telemetry/opentelemetry-go/blob/v1.37.0/sdk/go.mod
-    - https://github.com/open-telemetry/opentelemetry-go/blob/v1.37.0/sdk/log/go.mod
-    - https://github.com/open-telemetry/opentelemetry-go/blob/v1.37.0/sdk/log/logtest/go.mod
-    - https://github.com/open-telemetry/opentelemetry-go/blob/v1.37.0/sdk/metric/go.mod
-    - https://github.com/open-telemetry/opentelemetry-go/blob/v1.37.0/trace/go.mod
-    - https://github.com/open-telemetry/opentelemetry-go/blob/v1.37.0/trace/internal/telemetry/test/go.mod
-  dependencies-lifecycle:
-    policy-url: https://github.com/open-telemetry/opentelemetry-go/blob/69e81088ad40f45a0764597326722dea8f3f00a8/CONTRIBUTING.md
-    comment: |
-      Dependency lifecycle managed via go.mod and renovatebot.
-  env-dependencies-policy:
-    policy-url: https://github.com/open-telemetry/opentelemetry-go/blob/69e81088ad40f45a0764597326722dea8f3f00a8/CONTRIBUTING.md
-    comment: |
-      See contributing policy for environment usage.

src/runtime/vendor/go.opentelemetry.io/otel/VERSIONING.md

@@ -83,7 +83,7 @@ is designed so the following goals can be achieved.
       in either the module path or the import path.
   * In addition to public APIs, telemetry produced by stable instrumentation
     will remain stable and backwards compatible. This is to avoid breaking
-    alerts and dashboards.
+    alerts and dashboard.
   * Modules will be used to encapsulate instrumentation, detectors, exporters,
     propagators, and any other independent sets of related components.
     * Experimental modules still under active development will be versioned at

src/runtime/vendor/go.opentelemetry.io/otel/attribute/encoder.go

@@ -16,7 +16,7 @@ type (
 	// set into a wire representation.
 	Encoder interface {
 		// Encode returns the serialized encoding of the attribute set using
-		// its Iterator. This result may be cached by an attribute.Set.
+		// its Iterator. This result may be cached by a attribute.Set.
 		Encode(iterator Iterator) string
 
 		// ID returns a value that is unique for each class of attribute
@@ -78,7 +78,7 @@ func DefaultEncoder() Encoder {
 	defaultEncoderOnce.Do(func() {
 		defaultEncoderInstance = &defaultAttrEncoder{
 			pool: sync.Pool{
-				New: func() any {
+				New: func() interface{} {
 					return &bytes.Buffer{}
 				},
 			},
@@ -96,11 +96,11 @@ func (d *defaultAttrEncoder) Encode(iter Iterator) string {
 	for iter.Next() {
 		i, keyValue := iter.IndexedAttribute()
 		if i > 0 {
-			_ = buf.WriteByte(',')
+			_, _ = buf.WriteRune(',')
 		}
 		copyAndEscape(buf, string(keyValue.Key))
 
-		_ = buf.WriteByte('=')
+		_, _ = buf.WriteRune('=')
 
 		if keyValue.Value.Type() == STRING {
 			copyAndEscape(buf, keyValue.Value.AsString())
@@ -122,14 +122,14 @@ func copyAndEscape(buf *bytes.Buffer, val string) {
 	for _, ch := range val {
 		switch ch {
 		case '=', ',', escapeChar:
-			_ = buf.WriteByte(escapeChar)
+			_, _ = buf.WriteRune(escapeChar)
 		}
 		_, _ = buf.WriteRune(ch)
 	}
 }
 
-// Valid reports whether this encoder ID was allocated by
-// [NewEncoderID]. Invalid encoder IDs will not be cached.
+// Valid returns true if this encoder ID was allocated by
+// `NewEncoderID`.  Invalid encoder IDs will not be cached.
 func (id EncoderID) Valid() bool {
 	return id.value != 0
 }

src/runtime/vendor/go.opentelemetry.io/otel/attribute/filter.go

@@ -15,11 +15,11 @@ type Filter func(KeyValue) bool
 //
 // If keys is empty a deny-all filter is returned.
 func NewAllowKeysFilter(keys ...Key) Filter {
-	if len(keys) == 0 {
-		return func(KeyValue) bool { return false }
+	if len(keys) <= 0 {
+		return func(kv KeyValue) bool { return false }
 	}
 
-	allowed := make(map[Key]struct{}, len(keys))
+	allowed := make(map[Key]struct{})
 	for _, k := range keys {
 		allowed[k] = struct{}{}
 	}
@@ -34,11 +34,11 @@ func NewAllowKeysFilter(keys ...Key) Filter {
 //
 // If keys is empty an allow-all filter is returned.
 func NewDenyKeysFilter(keys ...Key) Filter {
-	if len(keys) == 0 {
-		return func(KeyValue) bool { return true }
+	if len(keys) <= 0 {
+		return func(kv KeyValue) bool { return true }
 	}
 
-	forbid := make(map[Key]struct{}, len(keys))
+	forbid := make(map[Key]struct{})
 	for _, k := range keys {
 		forbid[k] = struct{}{}
 	}

src/runtime/vendor/go.opentelemetry.io/otel/attribute/hash.go

@@ -1,92 +0,0 @@
-// Copyright The OpenTelemetry Authors
-// SPDX-License-Identifier: Apache-2.0
-
-package attribute // import "go.opentelemetry.io/otel/attribute"
-
-import (
-	"fmt"
-	"reflect"
-
-	"go.opentelemetry.io/otel/attribute/internal/xxhash"
-)
-
-// Type identifiers. These identifiers are hashed before the value of the
-// corresponding type. This is done to distinguish values that are hashed with
-// the same value representation (e.g. `int64(1)` and `true`, []int64{0} and
-// int64(0)).
-//
-// These are all 8 byte length strings converted to a uint64 representation. A
-// uint64 is used instead of the string directly as an optimization, it avoids
-// the for loop in [xxhash] which adds minor overhead.
-const (
-	boolID         uint64 = 7953749933313450591 // "_boolean" (little endian)
-	int64ID        uint64 = 7592915492740740150 // "64_bit_i" (little endian)
-	float64ID      uint64 = 7376742710626956342 // "64_bit_f" (little endian)
-	stringID       uint64 = 6874584755375207263 // "_string_" (little endian)
-	boolSliceID    uint64 = 6875993255270243167 // "_[]bool_" (little endian)
-	int64SliceID   uint64 = 3762322556277578591 // "_[]int64" (little endian)
-	float64SliceID uint64 = 7308324551835016539 // "[]double" (little endian)
-	stringSliceID  uint64 = 7453010373645655387 // "[]string" (little endian)
-)
-
-// hashKVs returns a new xxHash64 hash of kvs.
-func hashKVs(kvs []KeyValue) uint64 {
-	h := xxhash.New()
-	for _, kv := range kvs {
-		h = hashKV(h, kv)
-	}
-	return h.Sum64()
-}
-
-// hashKV returns the xxHash64 hash of kv with h as the base.
-func hashKV(h xxhash.Hash, kv KeyValue) xxhash.Hash {
-	h = h.String(string(kv.Key))
-
-	switch kv.Value.Type() {
-	case BOOL:
-		h = h.Uint64(boolID)
-		h = h.Uint64(kv.Value.numeric)
-	case INT64:
-		h = h.Uint64(int64ID)
-		h = h.Uint64(kv.Value.numeric)
-	case FLOAT64:
-		h = h.Uint64(float64ID)
-		// Assumes numeric stored with math.Float64bits.
-		h = h.Uint64(kv.Value.numeric)
-	case STRING:
-		h = h.Uint64(stringID)
-		h = h.String(kv.Value.stringly)
-	case BOOLSLICE:
-		h = h.Uint64(boolSliceID)
-		rv := reflect.ValueOf(kv.Value.slice)
-		for i := 0; i < rv.Len(); i++ {
-			h = h.Bool(rv.Index(i).Bool())
-		}
-	case INT64SLICE:
-		h = h.Uint64(int64SliceID)
-		rv := reflect.ValueOf(kv.Value.slice)
-		for i := 0; i < rv.Len(); i++ {
-			h = h.Int64(rv.Index(i).Int())
-		}
-	case FLOAT64SLICE:
-		h = h.Uint64(float64SliceID)
-		rv := reflect.ValueOf(kv.Value.slice)
-		for i := 0; i < rv.Len(); i++ {
-			h = h.Float64(rv.Index(i).Float())
-		}
-	case STRINGSLICE:
-		h = h.Uint64(stringSliceID)
-		rv := reflect.ValueOf(kv.Value.slice)
-		for i := 0; i < rv.Len(); i++ {
-			h = h.String(rv.Index(i).String())
-		}
-	case INVALID:
-	default:
-		// Logging is an alternative, but using the internal logger here
-		// causes an import cycle so it is not done.
-		v := kv.Value.AsInterface()
-		msg := fmt.Sprintf("unknown value type: %[1]v (%[1]T)", v)
-		panic(msg)
-	}
-	return h
-}

src/runtime/vendor/go.opentelemetry.io/otel/attribute/internal/xxhash/xxhash.go

@@ -1,64 +0,0 @@
-// Copyright The OpenTelemetry Authors
-// SPDX-License-Identifier: Apache-2.0
-
-// Package xxhash provides a wrapper around the xxhash library for attribute hashing.
-package xxhash // import "go.opentelemetry.io/otel/attribute/internal/xxhash"
-
-import (
-	"encoding/binary"
-	"math"
-
-	"github.com/cespare/xxhash/v2"
-)
-
-// Hash wraps xxhash.Digest to provide an API friendly for hashing attribute values.
-type Hash struct {
-	d *xxhash.Digest
-}
-
-// New returns a new initialized xxHash64 hasher.
-func New() Hash {
-	return Hash{d: xxhash.New()}
-}
-
-func (h Hash) Uint64(val uint64) Hash {
-	var buf [8]byte
-	binary.LittleEndian.PutUint64(buf[:], val)
-	// errors from Write are always nil for xxhash
-	// if it returns an err then panic
-	_, err := h.d.Write(buf[:])
-	if err != nil {
-		panic("xxhash write of uint64 failed: " + err.Error())
-	}
-	return h
-}
-
-func (h Hash) Bool(val bool) Hash { // nolint:revive // This is a hashing function.
-	if val {
-		return h.Uint64(1)
-	}
-	return h.Uint64(0)
-}
-
-func (h Hash) Float64(val float64) Hash {
-	return h.Uint64(math.Float64bits(val))
-}
-
-func (h Hash) Int64(val int64) Hash {
-	return h.Uint64(uint64(val)) // nolint:gosec // Overflow doesn't matter since we are hashing.
-}
-
-func (h Hash) String(val string) Hash {
-	// errors from WriteString are always nil for xxhash
-	// if it returns an err then panic
-	_, err := h.d.WriteString(val)
-	if err != nil {
-		panic("xxhash write of string failed: " + err.Error())
-	}
-	return h
-}
-
-// Sum64 returns the current hash value.
-func (h Hash) Sum64() uint64 {
-	return h.d.Sum64()
-}

src/runtime/vendor/go.opentelemetry.io/otel/attribute/iterator.go

@@ -25,8 +25,8 @@ type oneIterator struct {
 	attr KeyValue
 }
 
-// Next moves the iterator to the next position.
-// Next reports whether there are more attributes.
+// Next moves the iterator to the next position. Returns false if there are no
+// more attributes.
 func (i *Iterator) Next() bool {
 	i.idx++
 	return i.idx < i.Len()
@@ -106,8 +106,7 @@ func (oi *oneIterator) advance() {
 	}
 }
 
-// Next moves the iterator to the next position.
-// Next reports whether there is another attribute available.
+// Next returns true if there is another attribute available.
 func (m *MergeIterator) Next() bool {
 	if m.one.done && m.two.done {
 		return false

src/runtime/vendor/go.opentelemetry.io/otel/attribute/key.go

@@ -117,7 +117,7 @@ func (k Key) StringSlice(v []string) KeyValue {
 	}
 }
 
-// Defined reports whether the key is not empty.
+// Defined returns true for non-empty keys.
 func (k Key) Defined() bool {
 	return len(k) != 0
 }

src/runtime/vendor/go.opentelemetry.io/otel/attribute/kv.go

@@ -13,7 +13,7 @@ type KeyValue struct {
 	Value Value
 }
 
-// Valid reports whether kv is a valid OpenTelemetry attribute.
+// Valid returns if kv is a valid OpenTelemetry attribute.
 func (kv KeyValue) Valid() bool {
 	return kv.Key.Defined() && kv.Value.Type() != INVALID
 }

src/runtime/vendor/go.opentelemetry.io/otel/attribute/rawhelpers.go

@@ -1,37 +0,0 @@
-// Copyright The OpenTelemetry Authors
-// SPDX-License-Identifier: Apache-2.0
-
-package attribute // import "go.opentelemetry.io/otel/attribute"
-
-import (
-	"math"
-)
-
-func boolToRaw(b bool) uint64 { // nolint:revive  // b is not a control flag.
-	if b {
-		return 1
-	}
-	return 0
-}
-
-func rawToBool(r uint64) bool {
-	return r != 0
-}
-
-func int64ToRaw(i int64) uint64 {
-	// Assumes original was a valid int64 (overflow not checked).
-	return uint64(i) // nolint: gosec
-}
-
-func rawToInt64(r uint64) int64 {
-	// Assumes original was a valid int64 (overflow not checked).
-	return int64(r) // nolint: gosec
-}
-
-func float64ToRaw(f float64) uint64 {
-	return math.Float64bits(f)
-}
-
-func rawToFloat64(r uint64) float64 {
-	return math.Float64frombits(r)
-}

src/runtime/vendor/go.opentelemetry.io/otel/attribute/set.go

@@ -9,8 +9,6 @@ import (
 	"reflect"
 	"slices"
 	"sort"
-
-	"go.opentelemetry.io/otel/attribute/internal/xxhash"
 )
 
 type (
@@ -25,19 +23,19 @@ type (
 	// the Equals method to ensure stable equivalence checking.
 	//
 	// Users should also use the Distinct returned from Equivalent as a map key
-	// instead of a Set directly. Set has relatively poor performance when used
-	// as a map key compared to Distinct.
+	// instead of a Set directly. In addition to that type providing guarantees
+	// on stable equivalence, it may also provide performance improvements.
 	Set struct {
-		hash uint64
-		data any
+		equivalent Distinct
 	}
 
-	// Distinct is an identifier of a Set which is very likely to be unique.
+	// Distinct is a unique identifier of a Set.
 	//
-	// Distinct should be used as a map key instead of a Set for to provide better
-	// performance for map operations.
+	// Distinct is designed to be ensures equivalence stability: comparisons
+	// will return the save value across versions. For this reason, Distinct
+	// should always be used as a map key instead of a Set.
 	Distinct struct {
-		hash uint64
+		iface interface{}
 	}
 
 	// Sortable implements sort.Interface, used for sorting KeyValue.
@@ -48,34 +46,15 @@ type (
 	Sortable []KeyValue
 )
 
-// Compile time check these types remain comparable.
-var (
-	_ = isComparable(Set{})
-	_ = isComparable(Distinct{})
-)
-
-func isComparable[T comparable](t T) T { return t }
-
 var (
 	// keyValueType is used in computeDistinctReflect.
-	keyValueType = reflect.TypeFor[KeyValue]()
+	keyValueType = reflect.TypeOf(KeyValue{})
 
-	// emptyHash is the hash of an empty set.
-	emptyHash = xxhash.New().Sum64()
-
-	// userDefinedEmptySet is an empty set. It was mistakenly exposed to users
-	// as something they can assign to, so it must remain addressable and
-	// mutable.
-	//
-	// This is kept for backwards compatibility, but should not be used in new code.
-	userDefinedEmptySet = &Set{
-		hash: emptyHash,
-		data: [0]KeyValue{},
-	}
-
-	emptySet = Set{
-		hash: emptyHash,
-		data: [0]KeyValue{},
+	// emptySet is returned for empty attribute sets.
+	emptySet = &Set{
+		equivalent: Distinct{
+			iface: [0]KeyValue{},
+		},
 	}
 )
 
@@ -83,35 +62,33 @@ var (
 //
 // This is a convenience provided for optimized calling utility.
 func EmptySet() *Set {
-	// Continue to return the pointer to the user-defined empty set for
-	// backwards-compatibility.
-	//
-	// New code should not use this, instead use emptySet.
-	return userDefinedEmptySet
+	return emptySet
 }
 
-// Valid reports whether this value refers to a valid Set.
-func (d Distinct) Valid() bool { return d.hash != 0 }
-
 // reflectValue abbreviates reflect.ValueOf(d).
-func (l Set) reflectValue() reflect.Value {
-	return reflect.ValueOf(l.data)
+func (d Distinct) reflectValue() reflect.Value {
+	return reflect.ValueOf(d.iface)
+}
+
+// Valid returns true if this value refers to a valid Set.
+func (d Distinct) Valid() bool {
+	return d.iface != nil
 }
 
 // Len returns the number of attributes in this set.
 func (l *Set) Len() int {
-	if l == nil || l.hash == 0 {
+	if l == nil || !l.equivalent.Valid() {
 		return 0
 	}
-	return l.reflectValue().Len()
+	return l.equivalent.reflectValue().Len()
 }
 
 // Get returns the KeyValue at ordered position idx in this set.
 func (l *Set) Get(idx int) (KeyValue, bool) {
-	if l == nil || l.hash == 0 {
+	if l == nil || !l.equivalent.Valid() {
 		return KeyValue{}, false
 	}
-	value := l.reflectValue()
+	value := l.equivalent.reflectValue()
 
 	if idx >= 0 && idx < value.Len() {
 		// Note: The Go compiler successfully avoids an allocation for
@@ -124,10 +101,10 @@ func (l *Set) Get(idx int) (KeyValue, bool) {
 
 // Value returns the value of a specified key in this set.
 func (l *Set) Value(k Key) (Value, bool) {
-	if l == nil || l.hash == 0 {
+	if l == nil || !l.equivalent.Valid() {
 		return Value{}, false
 	}
-	rValue := l.reflectValue()
+	rValue := l.equivalent.reflectValue()
 	vlen := rValue.Len()
 
 	idx := sort.Search(vlen, func(idx int) bool {
@@ -143,7 +120,7 @@ func (l *Set) Value(k Key) (Value, bool) {
 	return Value{}, false
 }
 
-// HasValue reports whether a key is defined in this set.
+// HasValue tests whether a key is defined in this set.
 func (l *Set) HasValue(k Key) bool {
 	if l == nil {
 		return false
@@ -167,29 +144,20 @@ func (l *Set) ToSlice() []KeyValue {
 	return iter.ToSlice()
 }
 
-// Equivalent returns a value that may be used as a map key. Equal Distinct
-// values are very likely to be equivalent attribute Sets. Distinct value of any
+// Equivalent returns a value that may be used as a map key. The Distinct type
+// guarantees that the result will equal the equivalent. Distinct value of any
 // attribute set with the same elements as this, where sets are made unique by
 // choosing the last value in the input for any given key.
 func (l *Set) Equivalent() Distinct {
-	if l == nil || l.hash == 0 {
-		return Distinct{hash: emptySet.hash}
+	if l == nil || !l.equivalent.Valid() {
+		return emptySet.equivalent
 	}
-	return Distinct{hash: l.hash}
+	return l.equivalent
 }
 
-// Equals reports whether the argument set is equivalent to this set.
+// Equals returns true if the argument set is equivalent to this set.
 func (l *Set) Equals(o *Set) bool {
-	if l.Equivalent() != o.Equivalent() {
-		return false
-	}
-	if l == nil || l.hash == 0 {
-		l = &emptySet
-	}
-	if o == nil || o.hash == 0 {
-		o = &emptySet
-	}
-	return l.data == o.data
+	return l.Equivalent() == o.Equivalent()
 }
 
 // Encoded returns the encoded form of this set, according to encoder.
@@ -201,6 +169,12 @@ func (l *Set) Encoded(encoder Encoder) string {
 	return encoder.Encode(l.Iter())
 }
 
+func empty() Set {
+	return Set{
+		equivalent: emptySet.equivalent,
+	}
+}
+
 // NewSet returns a new Set. See the documentation for
 // NewSetWithSortableFiltered for more details.
 //
@@ -230,7 +204,7 @@ func NewSetWithSortable(kvs []KeyValue, _ *Sortable) Set {
 func NewSetWithFiltered(kvs []KeyValue, filter Filter) (Set, []KeyValue) {
 	// Check for empty set.
 	if len(kvs) == 0 {
-		return emptySet, nil
+		return empty(), nil
 	}
 
 	// Stable sort so the following de-duplication can implement
@@ -259,10 +233,10 @@ func NewSetWithFiltered(kvs []KeyValue, filter Filter) (Set, []KeyValue) {
 
 	if filter != nil {
 		if div := filteredToFront(kvs, filter); div != 0 {
-			return newSet(kvs[div:]), kvs[:div]
+			return Set{equivalent: computeDistinct(kvs[div:])}, kvs[:div]
 		}
 	}
-	return newSet(kvs), nil
+	return Set{equivalent: computeDistinct(kvs)}, nil
 }
 
 // NewSetWithSortableFiltered returns a new Set.
@@ -342,7 +316,7 @@ func (l *Set) Filter(re Filter) (Set, []KeyValue) {
 	if first == 0 {
 		// It is safe to assume len(slice) >= 1 given we found at least one
 		// attribute above that needs to be filtered out.
-		return newSet(slice[1:]), slice[:1]
+		return Set{equivalent: computeDistinct(slice[1:])}, slice[:1]
 	}
 
 	// Move the filtered slice[first] to the front (preserving order).
@@ -352,24 +326,25 @@ func (l *Set) Filter(re Filter) (Set, []KeyValue) {
 
 	// Do not re-evaluate re(slice[first+1:]).
 	div := filteredToFront(slice[1:first+1], re) + 1
-	return newSet(slice[div:]), slice[:div]
+	return Set{equivalent: computeDistinct(slice[div:])}, slice[:div]
 }
 
-// newSet returns a new set based on the sorted and uniqued kvs.
-func newSet(kvs []KeyValue) Set {
-	s := Set{
-		hash: hashKVs(kvs),
-		data: computeDataFixed(kvs),
+// computeDistinct returns a Distinct using either the fixed- or
+// reflect-oriented code path, depending on the size of the input. The input
+// slice is assumed to already be sorted and de-duplicated.
+func computeDistinct(kvs []KeyValue) Distinct {
+	iface := computeDistinctFixed(kvs)
+	if iface == nil {
+		iface = computeDistinctReflect(kvs)
 	}
-	if s.data == nil {
-		s.data = computeDataReflect(kvs)
+	return Distinct{
+		iface: iface,
 	}
-	return s
 }
 
-// computeDataFixed computes a Set data for small slices. It returns nil if the
-// input is too large for this code path.
-func computeDataFixed(kvs []KeyValue) any {
+// computeDistinctFixed computes a Distinct for small slices. It returns nil
+// if the input is too large for this code path.
+func computeDistinctFixed(kvs []KeyValue) interface{} {
 	switch len(kvs) {
 	case 1:
 		return [1]KeyValue(kvs)
@@ -396,9 +371,9 @@ func computeDataFixed(kvs []KeyValue) any {
 	}
 }
 
-// computeDataReflect computes a Set data using reflection, works for any size
-// input.
-func computeDataReflect(kvs []KeyValue) any {
+// computeDistinctReflect computes a Distinct using reflection, works for any
+// size input.
+func computeDistinctReflect(kvs []KeyValue) interface{} {
 	at := reflect.New(reflect.ArrayOf(len(kvs), keyValueType)).Elem()
 	for i, keyValue := range kvs {
 		*(at.Index(i).Addr().Interface().(*KeyValue)) = keyValue
@@ -408,11 +383,11 @@ func computeDataReflect(kvs []KeyValue) any {
 
 // MarshalJSON returns the JSON encoding of the Set.
 func (l *Set) MarshalJSON() ([]byte, error) {
-	return json.Marshal(l.data)
+	return json.Marshal(l.equivalent.iface)
 }
 
 // MarshalLog is the marshaling function used by the logging system to represent this Set.
-func (l Set) MarshalLog() any {
+func (l Set) MarshalLog() interface{} {
 	kvs := make(map[string]string)
 	for _, kv := range l.ToSlice() {
 		kvs[string(kv.Key)] = kv.Value.Emit()

src/runtime/vendor/go.opentelemetry.io/otel/attribute/type_string.go

@@ -24,9 +24,8 @@ const _Type_name = "INVALIDBOOLINT64FLOAT64STRINGBOOLSLICEINT64SLICEFLOAT64SLICE
 var _Type_index = [...]uint8{0, 7, 11, 16, 23, 29, 38, 48, 60, 71}
 
 func (i Type) String() string {
-	idx := int(i) - 0
-	if i < 0 || idx >= len(_Type_index)-1 {
+	if i < 0 || i >= Type(len(_Type_index)-1) {
 		return "Type(" + strconv.FormatInt(int64(i), 10) + ")"
 	}
-	return _Type_name[_Type_index[idx]:_Type_index[idx+1]]
+	return _Type_name[_Type_index[i]:_Type_index[i+1]]
 }