chore: update pkgs/tools/extras for Go 1.23.3

Bump some dependencies as well. Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
2025-10-29 19:52:44 +00:00 · 2024-11-12 15:49:56 +04:00
parent 20bbf02355
commit 9916e2cd8a
57 changed files with 246 additions and 227 deletions
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -39,7 +39,7 @@ linters-settings:
  errcheck:
    # report about not checking of errors in type assetions: `a := b.(MyStruct)`;
    # default is false: such cases aren't reported by default.
-    check-type-assertions: true
+    check-type-assertions: false # we have forcetypeassert linter for it

    # report about assignment of errors to blank identifier: `num, _ := strconv.Atoi(numStr)`;
    # default is false: such cases aren't reported by default.
@@ -148,6 +148,7 @@ linters:
    - inamedparam # too annoying
    - protogetter # too annoying
    - perfsprint
+    - recvcheck # too annoying
  disable-all: false
  fast: false

--- a/18
+++ b/18
@@ -1,4 +1,4 @@
-# syntax = docker/dockerfile-upstream:1.10.0-labs
+# syntax = docker/dockerfile-upstream:1.11.1-labs

 # Meta args applied to stage base names.

@@ -143,28 +143,28 @@ FROM ${PKG_KERNEL} AS pkg-kernel
 FROM --platform=amd64 ${PKG_KERNEL} AS pkg-kernel-amd64
 FROM --platform=arm64 ${PKG_KERNEL} AS pkg-kernel-arm64

-FROM --platform=amd64 ${TOOLS} as tools-amd64
-FROM --platform=arm64 ${TOOLS} as tools-arm64
+FROM --platform=amd64 ${TOOLS} AS tools-amd64
+FROM --platform=arm64 ${TOOLS} AS tools-arm64

-FROM scratch as pkg-debug-tools-scratch-amd64
-FROM scratch as pkg-debug-tools-scratch-arm64
+FROM scratch AS pkg-debug-tools-scratch-amd64
+FROM scratch AS pkg-debug-tools-scratch-arm64

-FROM scratch as pkg-debug-tools-bash-minimal-amd64
+FROM scratch AS pkg-debug-tools-bash-minimal-amd64
 COPY --from=tools-amd64 /toolchain/bin/bash /toolchain/bin/bash
 COPY --from=tools-amd64 /toolchain/lib/ld-musl-x86_64.so.1 /toolchain/toolchain/lib/ld-musl-x86_64.so.1
 COPY --from=tools-amd64 /toolchain/bin/cat /toolchain/bin/cat
 COPY --from=tools-amd64 /toolchain/bin/ls /toolchain/bin/ls
 COPY --from=tools-amd64 /toolchain/bin/tee /toolchain/bin/tee

-FROM scratch as pkg-debug-tools-bash-minimal-arm64
+FROM scratch AS pkg-debug-tools-bash-minimal-arm64
 COPY --from=tools-arm64 /toolchain/bin/bash /toolchain/bin/bash
 COPY --from=tools-arm64 /toolchain/lib/ld-musl-aarch64.so.1 /toolchain/toolchain/lib/ld-musl-aarch64.so.1
 COPY --from=tools-arm64 /toolchain/bin/cat /toolchain/bin/cat
 COPY --from=tools-arm64 /toolchain/bin/ls /toolchain/bin/ls
 COPY --from=tools-arm64 /toolchain/bin/tee /toolchain/bin/tee

-FROM pkg-debug-tools-${DEBUG_TOOLS_SOURCE}-amd64 as pkg-debug-tools-amd64
-FROM pkg-debug-tools-${DEBUG_TOOLS_SOURCE}-arm64 as pkg-debug-tools-arm64
+FROM pkg-debug-tools-${DEBUG_TOOLS_SOURCE}-amd64 AS pkg-debug-tools-amd64
+FROM pkg-debug-tools-${DEBUG_TOOLS_SOURCE}-arm64 AS pkg-debug-tools-arm64

 # Strip CNI package.

--- a/16
+++ b/16
@@ -17,13 +17,13 @@ ZSTD_COMPRESSION_LEVEL ?= 18
 CI_RELEASE_TAG := $(shell git log --oneline --format=%B -n 1 HEAD^2 -- 2>/dev/null | head -n 1 | sed -r "/^release\(.*\)/ s/^release\((.*)\):.*$$/\\1/; t; Q")

 ARTIFACTS := _out
-TOOLS ?= ghcr.io/siderolabs/tools:v1.9.0-alpha.0-7-g3750064
+TOOLS ?= ghcr.io/siderolabs/tools:v1.9.0-alpha.0-9-ge061b6f

 DEBUG_TOOLS_SOURCE := scratch

 PKGS_PREFIX ?= ghcr.io/siderolabs
-PKGS ?= v1.9.0-alpha.0-37-g4699763
-EXTRAS ?= v1.9.0-alpha.0-1-geab6e58
+PKGS ?= v1.9.0-alpha.0-40-g567a14a
+EXTRAS ?= v1.9.0-alpha.0-2-g78ba66b

 KRES_IMAGE ?= ghcr.io/siderolabs/kres:latest
 CONFORMANCE_IMAGE ?= ghcr.io/siderolabs/conform:latest
@@ -65,17 +65,17 @@ PKG_TALOSCTL_CNI_BUNDLE_INSTALL ?= $(PKGS_PREFIX)/talosctl-cni-bundle-install:$(
 # renovate: datasource=github-tags depName=golang/go
 GO_VERSION ?= 1.23
 # renovate: datasource=go depName=golang.org/x/tools
-GOIMPORTS_VERSION ?= v0.26.0
+GOIMPORTS_VERSION ?= v0.27.0
 # renovate: datasource=go depName=mvdan.cc/gofumpt
 GOFUMPT_VERSION ?= v0.7.0
 # renovate: datasource=go depName=github.com/golangci/golangci-lint
-GOLANGCILINT_VERSION ?= v1.61.0
+GOLANGCILINT_VERSION ?= v1.62.0
 # renovate: datasource=go depName=golang.org/x/tools
-STRINGER_VERSION ?= v0.26.0
+STRINGER_VERSION ?= v0.27.0
 # renovate: datasource=go depName=github.com/dmarkham/enumer
 ENUMER_VERSION ?= v1.5.10
 # renovate: datasource=go depName=k8s.io/code-generator
-DEEPCOPY_GEN_VERSION ?= v0.31.1
+DEEPCOPY_GEN_VERSION ?= v0.31.2
 # renovate: datasource=go depName=github.com/planetscale/vtprotobuf
 VTPROTOBUF_VERSION ?= v0.6.0
 # renovate: datasource=go depName=github.com/siderolabs/deep-copy
@@ -110,7 +110,7 @@ KUBESTR_VERSION ?= v0.4.46
 # renovate: datasource=github-releases depName=helm/helm
 HELM_VERSION ?= v3.16.2
 # renovate: datasource=github-releases depName=cilium/cilium-cli
-CILIUM_CLI_VERSION ?= v0.16.19
+CILIUM_CLI_VERSION ?= v0.16.20
 # renovate: datasource=github-releases depName=microsoft/secureboot_objects
 MICROSOFT_SECUREBOOT_RELEASE ?= v1.1.3

--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/siderolabs/talos

-go 1.23.2
+go 1.23.3

 replace (
 	// see e.g. https://github.com/grpc/grpc-go/issues/6696
@@ -53,12 +53,12 @@ require (
 	cloud.google.com/go/compute/metadata v0.5.2
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.16.0
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.0
-	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.2.0
-	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.2.0
+	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.3.0
+	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.3.0
 	github.com/alexflint/go-filemutex v1.3.0
-	github.com/aws/aws-sdk-go-v2/config v1.28.1
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.18
-	github.com/aws/aws-sdk-go-v2/service/kms v1.37.3
+	github.com/aws/aws-sdk-go-v2/config v1.28.3
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.19
+	github.com/aws/aws-sdk-go-v2/service/kms v1.37.5
 	github.com/aws/smithy-go v1.22.0
 	github.com/beevik/ntp v1.4.3
 	github.com/benbjohnson/clock v1.3.5 // project archived on 2023-05-18
@@ -69,7 +69,7 @@ require (
 	github.com/containerd/containerd/v2 v2.0.0
 	github.com/containerd/errdefs v1.0.0
 	github.com/containerd/platforms v1.0.0-rc.0
-	github.com/containerd/typeurl/v2 v2.2.2
+	github.com/containerd/typeurl/v2 v2.2.3
 	github.com/containernetworking/cni v1.2.3
 	github.com/containernetworking/plugins v1.6.0
 	github.com/coredns/coredns v1.11.3
@@ -81,7 +81,7 @@ require (
 	github.com/docker/go-connections v0.5.0
 	github.com/dustin/go-humanize v1.0.1
 	github.com/ecks/uefi v0.0.0-20221116212947-caef65d070eb
-	github.com/elastic/go-libaudit/v2 v2.5.1-0.20241104162019-1df86e79cca7
+	github.com/elastic/go-libaudit/v2 v2.6.0
 	github.com/fatih/color v1.18.0
 	github.com/florianl/go-tc v0.4.4
 	github.com/foxboron/go-uefi v0.0.0-20241017190036-fab4fdf2f2f3
@@ -97,20 +97,20 @@ require (
 	github.com/google/go-tpm v0.9.1
 	github.com/google/nftables v0.2.0
 	github.com/google/uuid v1.6.0
-	github.com/gopacket/gopacket v1.3.0
+	github.com/gopacket/gopacket v1.3.1
 	github.com/gosuri/uiprogress v0.0.1
 	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.1.0
 	github.com/hashicorp/go-cleanhttp v0.5.2
 	github.com/hashicorp/go-envparse v0.1.0
 	github.com/hashicorp/go-getter/v2 v2.2.3
 	github.com/hashicorp/go-multierror v1.1.1
-	github.com/hetznercloud/hcloud-go/v2 v2.15.0
+	github.com/hetznercloud/hcloud-go/v2 v2.16.0
 	github.com/insomniacslk/dhcp v0.0.0-20240829085014-a3a4c1f04475
 	github.com/jeromer/syslogparser v1.1.0
 	github.com/jsimonetti/rtnetlink/v2 v2.0.2
 	github.com/jxskiss/base62 v1.1.0
 	github.com/klauspost/compress v1.17.11
-	github.com/klauspost/cpuid/v2 v2.2.8
+	github.com/klauspost/cpuid/v2 v2.2.9
 	github.com/linode/go-metadata v0.2.1
 	github.com/martinlindhe/base36 v1.1.1
 	github.com/mattn/go-isatty v0.0.20
@@ -152,7 +152,7 @@ require (
 	github.com/siderolabs/go-debug v0.4.0
 	github.com/siderolabs/go-kmsg v0.1.4
 	github.com/siderolabs/go-kubeconfig v0.1.0
-	github.com/siderolabs/go-kubernetes v0.2.15
+	github.com/siderolabs/go-kubernetes v0.2.16
 	github.com/siderolabs/go-loadbalancer v0.3.4
 	github.com/siderolabs/go-pcidb v0.3.0
 	github.com/siderolabs/go-pointer v1.0.0
@@ -165,7 +165,7 @@ require (
 	github.com/siderolabs/kms-client v0.1.0
 	github.com/siderolabs/net v0.4.0
 	github.com/siderolabs/proto-codec v0.1.1
-	github.com/siderolabs/protoenc v0.2.1
+	github.com/siderolabs/protoenc v0.2.1 // indirect
 	github.com/siderolabs/siderolink v0.3.11
 	github.com/siderolabs/talos/pkg/machinery v1.9.0-alpha.2
 	github.com/spf13/cobra v1.8.1
@@ -182,31 +182,32 @@ require (
 	go.etcd.io/etcd/etcdutl/v3 v3.5.16
 	go.uber.org/zap v1.27.0
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba
-	golang.org/x/net v0.30.0
-	golang.org/x/oauth2 v0.23.0
-	golang.org/x/sync v0.8.0
-	golang.org/x/sys v0.26.0
-	golang.org/x/term v0.25.0
-	golang.org/x/text v0.19.0
-	golang.org/x/time v0.7.0
+	golang.org/x/net v0.31.0
+	golang.org/x/oauth2 v0.24.0
+	golang.org/x/sync v0.9.0
+	golang.org/x/sys v0.27.0
+	golang.org/x/term v0.26.0
+	golang.org/x/text v0.20.0
+	golang.org/x/time v0.8.0
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6
-	google.golang.org/grpc v1.67.1 // do not update to 1.68.0 until we find a way around https://github.com/grpc/grpc-go/pull/7535
+	google.golang.org/grpc v1.68.0 // do not update to 1.68.0 until we find a way around https://github.com/grpc/grpc-go/pull/7535
 	google.golang.org/protobuf v1.35.1
 	gopkg.in/yaml.v3 v3.0.1
 	k8s.io/klog/v2 v2.130.1
-	kernel.org/pub/linux/libs/security/libcap/cap v1.2.71
+	kernel.org/pub/linux/libs/security/libcap/cap v1.2.72
 	sigs.k8s.io/hydrophone v0.6.1-0.20240718103601-b92baf7e0b04
 	sigs.k8s.io/yaml v1.4.0
 )

 require (
+	cel.dev/expr v0.18.0 // indirect
 	github.com/0x5a17ed/itkit v0.6.0 // indirect
 	github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 // indirect
 	github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20231105174938-2b5cbb29f3e2 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.0 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
-	github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 // indirect
+	github.com/AzureAD/microsoft-authentication-library-for-go v1.3.1 // indirect
 	github.com/MakeNowJust/heredoc v1.0.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/Microsoft/hcsshim v0.12.9 // indirect
@@ -217,16 +218,16 @@ require (
 	github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
 	github.com/apparentlymart/go-cidr v1.1.0 // indirect
 	github.com/armon/circbuf v0.0.0-20190214190532-5111143e8da2 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.32.3 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.42 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.22 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.22 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.32.4 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.17.44 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.23 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.23 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.24.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.32.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.24.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.32.4 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
@@ -270,7 +271,7 @@ require (
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/btree v1.1.2 // indirect
-	github.com/google/cel-go v0.21.0 // indirect
+	github.com/google/cel-go v0.22.0 // indirect
 	github.com/google/gnostic-models v0.6.8 // indirect
 	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
@@ -355,7 +356,7 @@ require (
 	go.opentelemetry.io/otel/metric v1.31.0 // indirect
 	go.opentelemetry.io/otel/trace v1.31.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/crypto v0.28.0 // indirect
+	golang.org/x/crypto v0.29.0 // indirect
 	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
 	golang.org/x/mod v0.21.0 // indirect
 	golang.org/x/tools v0.26.0 // indirect
@@ -369,7 +370,7 @@ require (
 	k8s.io/cli-runtime v0.32.0-beta.0 // indirect
 	k8s.io/kube-openapi v0.0.0-20240827152857-f7e401e7b4c2 // indirect
 	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect
-	kernel.org/pub/linux/libs/security/libcap/psx v1.2.71 // indirect
+	kernel.org/pub/linux/libs/security/libcap/psx v1.2.72 // indirect
 	rsc.io/qr v0.2.0 // indirect
 	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
 	sigs.k8s.io/knftables v0.0.17 // indirect
--- a/go.sum
+++ b/go.sum
@@ -1,3 +1,5 @@
+cel.dev/expr v0.18.0 h1:CJ6drgk+Hf96lkLikr4rFf19WrU0BOWEihyZnI2TAzo=
+cel.dev/expr v0.18.0/go.mod h1:MrpN08Q+lEBs+bGYdLxxHkZoUSsCp0nSKTs0nTymJgw=
 cloud.google.com/go v0.100.2/go.mod h1:4Xra9TjzAeYHrl5+oeLlzbM2k3mjVhZh4UqTZ//w99A=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
 cloud.google.com/go/compute v0.1.0/go.mod h1:GAesmwr110a34z04OlxYkATPBEfVhkymfTBXtfbBFow=
@@ -20,18 +22,18 @@ github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.0 h1:+m0M/LFxN43KvUL
 github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.0/go.mod h1:PwOyop78lveYMRs6oCxjiVyBdyCgIYH6XHIVZO9/SFQ=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 h1:ywEEhmNahHBihViHepv3xPBn1663uRv2t2q/ESv9seY=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0/go.mod h1:iZDifYGJTIgIIkYRNWPENUnqx6bJ2xnSDFI2tjwZNuY=
-github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.2.0 h1:bOWx0pDRwHudx53ElibbtlzzcJbIC9foYGdqHQgi+88=
-github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.2.0/go.mod h1:r+2gKvCfqxaDW1a9mtIH9vJ0lT0ULJrKBGwbCPPjEwg=
-github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.2.0 h1:fKSH2aGSnt/ibGvis2f0gD3Lp10bzKr92FQxKutoNDc=
-github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.2.0/go.mod h1:TPR8de/4RyFL97NXnpjtIaLZFR0eQxlQeXbk7EKIrbw=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.3.0 h1:/eDk/OHTzMWrfI22PrUIVhRarQJFDzGkOXO3wtDcPlw=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.3.0/go.mod h1:1lU5bExBU6ZracUdREjnlgMa9nfgzxTS0w8I7b1fhCY=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.3.0 h1:7rKG7UmnrxX4N53TFhkYqjc+kVUZuw0fL8I3Fh+Ld9E=
+github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.3.0/go.mod h1:Wjo+24QJVhhl/L7jy6w9yzFF2yDOf3cKECAa8ecf9vE=
 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.0 h1:eXnN9kaS8TiDwXjoie3hMRLuwdUBUMW9KRgOqB3mCaw=
 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.0/go.mod h1:XIpam8wumeZ5rVMuhdDQLMfIPDf1WO3IzrCRO3e3e3o=
 github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0=
 github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM=
 github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 h1:XHOnouVk1mxXfQidrMEnLlPk9UMeRtyBTnEFtxkV0kU=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.3.1 h1:gUDtaZk8heteyfdmv+pcfHvhR9llnh7c7GMwZ8RVG04=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.3.1/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
 github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ4pzQ=
@@ -62,32 +64,32 @@ github.com/armon/circbuf v0.0.0-20190214190532-5111143e8da2/go.mod h1:3U/XgcO3hC
 github.com/armon/go-proxyproto v0.0.0-20210323213023-7e956b284f0a/go.mod h1:QmP9hvJ91BbJmGVGSbutW19IC0Q9phDCLGaomwTJbgU=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
-github.com/aws/aws-sdk-go-v2 v1.32.3 h1:T0dRlFBKcdaUPGNtkBSwHZxrtis8CQU17UpNBZYd0wk=
-github.com/aws/aws-sdk-go-v2 v1.32.3/go.mod h1:2SK5n0a2karNTv5tbP1SjsX0uhttou00v/HpXKM1ZUo=
-github.com/aws/aws-sdk-go-v2/config v1.28.1 h1:oxIvOUXy8x0U3fR//0eq+RdCKimWI900+SV+10xsCBw=
-github.com/aws/aws-sdk-go-v2/config v1.28.1/go.mod h1:bRQcttQJiARbd5JZxw6wG0yIK3eLeSCPdg6uqmmlIiI=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.42 h1:sBP0RPjBU4neGpIYyx8mkU2QqLPl5u9cmdTWVzIpHkM=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.42/go.mod h1:FwZBfU530dJ26rv9saAbxa9Ej3eF/AK0OAY86k13n4M=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.18 h1:68jFVtt3NulEzojFesM/WVarlFpCaXLKaBxDpzkQ9OQ=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.18/go.mod h1:Fjnn5jQVIo6VyedMc0/EhPpfNlPl7dHV916O6B+49aE=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.22 h1:Jw50LwEkVjuVzE1NzkhNKkBf9cRN7MtE1F/b2cOKTUM=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.22/go.mod h1:Y/SmAyPcOTmpeVaWSzSKiILfXTVJwrGmYZhcRbhWuEY=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.22 h1:981MHwBaRZM7+9QSR6XamDzF/o7ouUGxFzr+nVSIhrs=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.22/go.mod h1:1RA1+aBEfn+CAB/Mh0MB6LsdCYCnjZm7tKXtnk499ZQ=
+github.com/aws/aws-sdk-go-v2 v1.32.4 h1:S13INUiTxgrPueTmrm5DZ+MiAo99zYzHEFh1UNkOxNE=
+github.com/aws/aws-sdk-go-v2 v1.32.4/go.mod h1:2SK5n0a2karNTv5tbP1SjsX0uhttou00v/HpXKM1ZUo=
+github.com/aws/aws-sdk-go-v2/config v1.28.3 h1:kL5uAptPcPKaJ4q0sDUjUIdueO18Q7JDzl64GpVwdOM=
+github.com/aws/aws-sdk-go-v2/config v1.28.3/go.mod h1:SPEn1KA8YbgQnwiJ/OISU4fz7+F6Fe309Jf0QTsRCl4=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.44 h1:qqfs5kulLUHUEXlHEZXLJkgGoF3kkUeFUTVA585cFpU=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.44/go.mod h1:0Lm2YJ8etJdEdw23s+q/9wTpOeo2HhNE97XcRa7T8MA=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.19 h1:woXadbf0c7enQ2UGCi8gW/WuKmE0xIzxBF/eD94jMKQ=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.19/go.mod h1:zminj5ucw7w0r65bP6nhyOd3xL6veAUMc3ElGMoLVb4=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.23 h1:A2w6m6Tmr+BNXjDsr7M90zkWjsu4JXHwrzPg235STs4=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.23/go.mod h1:35EVp9wyeANdujZruvHiQUAo9E3vbhnIO1mTCAxMlY0=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.23 h1:pgYW9FCabt2M25MoHYCfMrVY2ghiiBKYWUVXfwZs+sU=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.23/go.mod h1:c48kLgzO19wAu3CPkDWC28JbaJ+hfQlsdl7I2+oqIbk=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 h1:VaRN3TlFdd6KxX1x3ILT5ynH6HvKgqdiXoTxAF4HQcQ=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1/go.mod h1:FbtygfRFze9usAadmnGJNc8KsP346kEe+y2/oyhGAGc=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.0 h1:TToQNkvGguu209puTojY/ozlqy2d/SFNcoLIqTFi42g=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.0/go.mod h1:0jp+ltwkf+SwG2fm/PKo8t4y8pJSgOCO4D8Lz3k0aHQ=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.3 h1:qcxX0JYlgWH3hpPUnd6U0ikcl6LLA9sLkXE2w1fpMvY=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.3/go.mod h1:cLSNEmI45soc+Ef8K/L+8sEA3A3pYFEYf5B5UI+6bH4=
-github.com/aws/aws-sdk-go-v2/service/kms v1.37.3 h1:VpyBA6KP6JgzwokQps8ArQPGy9rFej8adwuuQGcduH8=
-github.com/aws/aws-sdk-go-v2/service/kms v1.37.3/go.mod h1:TT/9V4PcmSPpd8LPUNJ8hBHJmpqcfhx6MrbWTkvyR+4=
-github.com/aws/aws-sdk-go-v2/service/sso v1.24.3 h1:UTpsIf0loCIWEbrqdLb+0RxnTXfWh2vhw4nQmFi4nPc=
-github.com/aws/aws-sdk-go-v2/service/sso v1.24.3/go.mod h1:FZ9j3PFHHAR+w0BSEjK955w5YD2UwB/l/H0yAK3MJvI=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.3 h1:2YCmIXv3tmiItw0LlYf6v7gEHebLY45kBEnPezbUKyU=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.3/go.mod h1:u19stRyNPxGhj6dRm+Cdgu6N75qnbW7+QN0q0dsAk58=
-github.com/aws/aws-sdk-go-v2/service/sts v1.32.3 h1:wVnQ6tigGsRqSWDEEyH6lSAJ9OyFUsSnbaUWChuSGzs=
-github.com/aws/aws-sdk-go-v2/service/sts v1.32.3/go.mod h1:VZa9yTFyj4o10YGsmDO4gbQJUvvhY72fhumT8W4LqsE=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.4 h1:tHxQi/XHPK0ctd/wdOw0t7Xrc2OxcRCnVzv8lwWPu0c=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.4/go.mod h1:4GQbF1vJzG60poZqWatZlhP31y8PGCCVTvIGPdaaYJ0=
+github.com/aws/aws-sdk-go-v2/service/kms v1.37.5 h1:5dQJ6Q5QrQOqZxXjSbRXukBqU8Pgu6Ro6Qqtyd8yiz4=
+github.com/aws/aws-sdk-go-v2/service/kms v1.37.5/go.mod h1:A9vfQcNHVBCE7ZZN6H+UUJpXtbH26Vv6L7Zhk5nIJAY=
+github.com/aws/aws-sdk-go-v2/service/sso v1.24.5 h1:HJwZwRt2Z2Tdec+m+fPjvdmkq2s9Ra+VR0hjF7V2o40=
+github.com/aws/aws-sdk-go-v2/service/sso v1.24.5/go.mod h1:wrMCEwjFPms+V86TCQQeOxQF/If4vT44FGIOFiMC2ck=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.4 h1:zcx9LiGWZ6i6pjdcoE9oXAB6mUdeyC36Ia/QEiIvYdg=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.4/go.mod h1:Tp/ly1cTjRLGBBmNccFumbZ8oqpZlpdhFf80SrRh4is=
+github.com/aws/aws-sdk-go-v2/service/sts v1.32.4 h1:yDxvkz3/uOKfxnv8YhzOi9m+2OGIxF+on3KOISbK5IU=
+github.com/aws/aws-sdk-go-v2/service/sts v1.32.4/go.mod h1:9XEUty5v5UAsMiFOBJrNibZgwCeOma73jgGwwhgffa8=
 github.com/aws/smithy-go v1.22.0 h1:uunKnWlcoL3zO7q+gG2Pk53joueEOsnNB28QdMsmiMM=
 github.com/aws/smithy-go v1.22.0/go.mod h1:irrKGvNn1InZwb2d7fkIRNucdfwR8R+Ts3wxYa/cJHg=
 github.com/beevik/ntp v1.4.3 h1:PlbTvE5NNy4QHmA4Mg57n7mcFTmr1W1j3gcK7L1lqho=
@@ -152,8 +154,8 @@ github.com/containerd/stargz-snapshotter/estargz v0.14.3 h1:OqlDCK3ZVUO6C3B/5FSk
 github.com/containerd/stargz-snapshotter/estargz v0.14.3/go.mod h1:KY//uOCIkSuNAHhJogcZtrNHdKrA99/FCCRjE3HD36o=
 github.com/containerd/ttrpc v1.2.6 h1:zG+Kn5EZ6MUYCS1t2Hmt2J4tMVaLSFEJVOraDQwNPC4=
 github.com/containerd/ttrpc v1.2.6/go.mod h1:YCXHsb32f+Sq5/72xHubdiJRQY9inL4a4ZQrAbN1q9o=
-github.com/containerd/typeurl/v2 v2.2.2 h1:3jN/k2ysKuPCsln5Qv8bzR9cxal8XjkxPogJfSNO31k=
-github.com/containerd/typeurl/v2 v2.2.2/go.mod h1:95ljDnPfD3bAbDJRugOiShd/DlAAsxGtUBhJxIn7SCk=
+github.com/containerd/typeurl/v2 v2.2.3 h1:yNA/94zxWdvYACdYO8zofhrTVuQY73fFU1y++dYSw40=
+github.com/containerd/typeurl/v2 v2.2.3/go.mod h1:95ljDnPfD3bAbDJRugOiShd/DlAAsxGtUBhJxIn7SCk=
 github.com/containernetworking/cni v1.2.3 h1:hhOcjNVUQTnzdRJ6alC5XF+wd9mfGIUaj8FuJbEslXM=
 github.com/containernetworking/cni v1.2.3/go.mod h1:DuLgF+aPd3DzcTQTtp/Nvl1Kim23oFKdm2okJzBQA5M=
 github.com/containernetworking/plugins v1.6.0 h1:lrsUrLF7QODLx6gncHOqk/pnCiC7c6bvDAskV4KUifQ=
@@ -203,8 +205,8 @@ github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkp
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/ecks/uefi v0.0.0-20221116212947-caef65d070eb h1:LZBZtPpqHDydudNAs2sHmo4Zp9bxEyxHdGCk3Fr6tv8=
 github.com/ecks/uefi v0.0.0-20221116212947-caef65d070eb/go.mod h1:jP/WitZVr91050NiqxEEp0ynBFbP2eUQC0CnxWPlQTA=
-github.com/elastic/go-libaudit/v2 v2.5.1-0.20241104162019-1df86e79cca7 h1:L+6IE+kDfWSJnDGB03gvyRir1tdbvlhiBFFjymxBoug=
-github.com/elastic/go-libaudit/v2 v2.5.1-0.20241104162019-1df86e79cca7/go.mod h1:8205nkf2oSrXFlO4H5j8/cyVMoSF3Y7jt+FjgS4ubQU=
+github.com/elastic/go-libaudit/v2 v2.6.0 h1:6RDK/q1cxtRI7hHLgLVKKFrgKsHQ0MFCf/O4guM6iKw=
+github.com/elastic/go-libaudit/v2 v2.6.0/go.mod h1:8205nkf2oSrXFlO4H5j8/cyVMoSF3Y7jt+FjgS4ubQU=
 github.com/elastic/go-licenser v0.4.1 h1:1xDURsc8pL5zYT9R29425J3vkHdt4RT5TNEMeRN48x4=
 github.com/elastic/go-licenser v0.4.1/go.mod h1:V56wHMpmdURfibNBggaSBfqgPxyT1Tldns1i87iTEvU=
 github.com/emicklei/dot v1.6.2 h1:08GN+DD79cy/tzN6uLCT84+2Wk9u+wvqP+Hkx/dIR8A=
@@ -309,8 +311,8 @@ github.com/google/btree v1.1.2 h1:xf4v41cLI2Z6FxbKm+8Bu+m8ifhj15JuZ9sa0jZCMUU=
 github.com/google/btree v1.1.2/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
 github.com/google/cadvisor v0.51.0 h1:BspqSPdZoLKrnvuZNOvM/KiJ/A+RdixwagN20n+2H8k=
 github.com/google/cadvisor v0.51.0/go.mod h1:czGE/c/P/i0QFpVNKTFrIEzord9Y10YfpwuaSWXELc0=
-github.com/google/cel-go v0.21.0 h1:cl6uW/gxN+Hy50tNYvI691+sXxioCnstFzLp2WO4GCI=
-github.com/google/cel-go v0.21.0/go.mod h1:rHUlWCcBKgyEk+eV03RPdZUekPp6YcJwV0FxuUksYxc=
+github.com/google/cel-go v0.22.0 h1:b3FJZxpiv1vTMo2/5RDUqAHPxkT8mmMfJIrq1llbf7g=
+github.com/google/cel-go v0.22.0/go.mod h1:BuznPXXfQDpXKWQ9sPW3TzlAJN5zzFe+i9tIs0yC4s8=
 github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
 github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
@@ -350,8 +352,8 @@ github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5m
 github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pfu6SK+H1/DsU0=
 github.com/googleapis/gax-go/v2 v2.1.1/go.mod h1:hddJymUZASv3XPyGkUpKj8pPO47Rmb0eJc8R6ouapiM=
 github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
-github.com/gopacket/gopacket v1.3.0 h1:MouZCc+ej0vnqzB0WeiaO/6+tGvb+KU7UczxoQ+X0Yc=
-github.com/gopacket/gopacket v1.3.0/go.mod h1:WnFrU1Xkf5lWKV38uKNR9+yYtppn+ZYzOyNqMeH4oNE=
+github.com/gopacket/gopacket v1.3.1 h1:ZppWyLrOJNZPe5XkdjLbtuTkfQoxQ0xyMJzQCqtqaPU=
+github.com/gopacket/gopacket v1.3.1/go.mod h1:3I13qcqSpB2R9fFQg866OOgzylYkZxLTmkvcXhvf6qg=
 github.com/gorilla/websocket v1.5.1 h1:gmztn0JnHVt9JZquRuzLw3g4wouNVzKL15iLr/zn/QY=
 github.com/gorilla/websocket v1.5.1/go.mod h1:x3kM2JMyaluk02fnUJpQuwD2dCS5NDG2ZHL0uE0tcaY=
 github.com/gosuri/uilive v0.0.4 h1:hUEBpQDj8D8jXgtCdBu7sWsy5sbW/5GhuO8KBwJ2jyY=
@@ -382,8 +384,8 @@ github.com/hashicorp/go-version v1.6.0 h1:feTTfFNnjP967rlCxM/I9g701jU+RN74YKx2mO
 github.com/hashicorp/go-version v1.6.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hetznercloud/hcloud-go/v2 v2.15.0 h1:6mpMJ/RuX1woZj+MCJdyKNEX9129KDkEIDeeyfr4GD4=
-github.com/hetznercloud/hcloud-go/v2 v2.15.0/go.mod h1:h8sHav+27Xa+48cVMAvAUMELov5h298Ilg2vflyTHgg=
+github.com/hetznercloud/hcloud-go/v2 v2.16.0 h1:s5wZFMX6/hZxONbD19pZ+JWvGaf2I7zH+f/Cem2ICAQ=
+github.com/hetznercloud/hcloud-go/v2 v2.16.0/go.mod h1:h8sHav+27Xa+48cVMAvAUMELov5h298Ilg2vflyTHgg=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/hugelgupf/socketpair v0.0.0-20190730060125-05d35a94e714 h1:/jC7qQFrv8CrSJVmaolDVOxTfS9kc36uB6H40kdbQq8=
@@ -429,8 +431,8 @@ github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
 github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
-github.com/klauspost/cpuid/v2 v2.2.8 h1:+StwCXwm9PdpiEkPyzBXIy+M9KUb4ODm0Zarf1kS5BM=
-github.com/klauspost/cpuid/v2 v2.2.8/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
+github.com/klauspost/cpuid/v2 v2.2.9 h1:66ze0taIn2H33fBvCkXuv9BmCwDfafmiIVpKV9kKGuY=
+github.com/klauspost/cpuid/v2 v2.2.9/go.mod h1:rqkxqrZ1EhYM9G+hXH7YdowN5R5RGN6NK4QwQ3WMXF8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
@@ -658,8 +660,8 @@ github.com/siderolabs/go-kmsg v0.1.4 h1:RLAa90O9bWuhA3pXPAYAdrI+kzcqTshZASRA5yso
 github.com/siderolabs/go-kmsg v0.1.4/go.mod h1:BLkt2N2DHT0wsFMz32lMw6vNEZL90c8ZnBjpIUoBb/M=
 github.com/siderolabs/go-kubeconfig v0.1.0 h1:t/2oMWkLSdWHXglKPMz8ySXnx6ZjHckeGY79NaDcBTo=
 github.com/siderolabs/go-kubeconfig v0.1.0/go.mod h1:eM3mO02Td6wYDvdi9zTbMrj1Q4WqEFN8XQ6pNjCUWkI=
-github.com/siderolabs/go-kubernetes v0.2.15 h1:NazXlfSI3u/eRzXwYsAsPbDuclzbJX9F7Cr0WB9vXQ4=
-github.com/siderolabs/go-kubernetes v0.2.15/go.mod h1:ElwMMmkNLrSRdAMqOouN9RZbO4G3CM5fJ0F5CBRsGRE=
+github.com/siderolabs/go-kubernetes v0.2.16 h1:sTvxsqx07zgPZRz2/vXKXRWV304biQ0JMnHckTVWrtg=
+github.com/siderolabs/go-kubernetes v0.2.16/go.mod h1:ElwMMmkNLrSRdAMqOouN9RZbO4G3CM5fJ0F5CBRsGRE=
 github.com/siderolabs/go-loadbalancer v0.3.4 h1:clxUefcY20djLdHMrh2j3rjVYDwDApXh1us/6cgrgoo=
 github.com/siderolabs/go-loadbalancer v0.3.4/go.mod h1:v0ziDvpArNRSF5LO0PIPQIPIYYHxX/fk+Vlg0wuSIiM=
 github.com/siderolabs/go-pcidb v0.3.0 h1:jR4w1YLNY8Cv1o5jnoQ2Q+pbxcosO2FVFrAAp1RURnw=
@@ -833,8 +835,8 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.28.0 h1:GBDwsMXVQi34v5CCYUm2jkJvu4cbtru2U4TN2PSyQnw=
-golang.org/x/crypto v0.28.0/go.mod h1:rmgy+3RHxRZMyY0jjAJShp2zgEdOqj2AO7U0pYmeQ7U=
+golang.org/x/crypto v0.29.0 h1:L5SG1JTTXupVV3n6sUqMTeWbjAyfPwoda2DLX8J8FrQ=
+golang.org/x/crypto v0.29.0/go.mod h1:+F4F4N5hv6v38hfeYwTdx20oUvLLc+QfrE9Ax9HtgRg=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8=
 golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
@@ -885,8 +887,8 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.30.0 h1:AcW1SDZMkb8IpzCdQUaIq2sP4sZ4zw+55h6ynffypl4=
-golang.org/x/net v0.30.0/go.mod h1:2wGyMJ5iFasEhkwi13ChkO/t1ECNC4X4eBKkVFyYFlU=
+golang.org/x/net v0.31.0 h1:68CPQngjLL0r2AlUKiSxtQFKvzRVbnzLwMUn5SzcLHo=
+golang.org/x/net v0.31.0/go.mod h1:P4fl1q7dY2hnZFxEk4pPSkDHF+QqjitcnDjUQyMM+pM=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -895,8 +897,8 @@ golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ
 golang.org/x/oauth2 v0.0.0-20210805134026-6f1e6394065a/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.23.0 h1:PbgcYx2W7i4LvjJWEbf0ngHV6qJYr86PkAV3bXdLEbs=
-golang.org/x/oauth2 v0.23.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/oauth2 v0.24.0 h1:KTBBxWqUa0ykRPLtV69rRto9TLXcqYkeswu48x/gvNE=
+golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -908,8 +910,8 @@ golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
-golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.9.0 h1:fEo0HyrW1GIgZdpbhCRO0PkJajUS5H9IFUztCgEo2jQ=
+golang.org/x/sync v0.9.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -969,16 +971,16 @@ golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.23.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.26.0 h1:KHjCJyddX0LoSTb3J+vWpupP9p0oznkqVk/IfjymZbo=
-golang.org/x/sys v0.26.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.27.0 h1:wBqf8DvsY9Y/2P8gAfPDEYNuS30J4lPHJxXSb/nJZ+s=
+golang.org/x/sys v0.27.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
-golang.org/x/term v0.25.0 h1:WtHI/ltw4NvSUig5KARz9h521QvRC8RmF/cuYqifU24=
-golang.org/x/term v0.25.0/go.mod h1:RPyXicDX+6vLxogjjRxjgD2TKtmAO6NZBsBRfrOLu7M=
+golang.org/x/term v0.26.0 h1:WEQa6V3Gja/BhNxg540hBip/kkaYtRg3cxg4oXSw4AU=
+golang.org/x/term v0.26.0/go.mod h1:Si5m1o57C5nBNQo5z1iq+XDijt21BDBDp2bK0QI8e3E=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -989,10 +991,10 @@ golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.19.0 h1:kTxAhCbGbxhK0IwgSKiMO5awPoDQ0RpfiVYBfK860YM=
-golang.org/x/text v0.19.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
-golang.org/x/time v0.7.0 h1:ntUhktv3OPE6TgYxXWv9vKvUSJyIFJlyohwbkEwPrKQ=
-golang.org/x/time v0.7.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/text v0.20.0 h1:gK/Kv2otX8gz+wn7Rmb3vT96ZwuoxnQlY+HlJVj7Qug=
+golang.org/x/text v0.20.0/go.mod h1:D4IsuqiFMhST5bX19pQ9ikHC2GsaKyk/oF+pn3ducp4=
+golang.org/x/time v0.8.0 h1:9i3RxcPv3PZnitoVGMPDKZSq1xW1gK1Xy3ArNOGZfEg=
+golang.org/x/time v0.8.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -1068,8 +1070,8 @@ google.golang.org/grpc v1.39.0/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnD
 google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
 google.golang.org/grpc v1.40.1/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.67.1 h1:zWnc1Vrcno+lHZCOofnIMvycFcc0QRGIzm9dhnDX68E=
-google.golang.org/grpc v1.67.1/go.mod h1:1gLDyUQU7CTLJI90u3nXZ9ekeghjeM7pTDZlqFNg2AA=
+google.golang.org/grpc v1.68.0 h1:aHQeeJbo8zAkAa3pRzrVjZlbz6uSfeOXlJNQM0RAbz0=
+google.golang.org/grpc v1.68.0/go.mod h1:fmSPC5AsjSBCK54MyHRx48kpOti1/jRfOlwEWywNjWA=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
@@ -1135,10 +1137,10 @@ k8s.io/pod-security-admission v0.32.0-beta.0 h1:ZwnZSBbk1/8ePVptfVle5Kslu5P0+rcv
 k8s.io/pod-security-admission v0.32.0-beta.0/go.mod h1:j5KKS6xRyxV1pv2j7r6D5m6dAX7NSoyxHo4WTCU0Faw=
 k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 h1:M3sRQVHv7vB20Xc2ybTt7ODCeFj6JSWYFzOFnYeS6Ro=
 k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-kernel.org/pub/linux/libs/security/libcap/cap v1.2.71 h1:M/uExTYLPOeX6EGZ3PGeCD4pbbvpdF8TyU1X8/b51oU=
-kernel.org/pub/linux/libs/security/libcap/cap v1.2.71/go.mod h1:p6YwxVCVAgpn8NL1FiZOnoSuwqaGBDdWeb3suWEDUxM=
-kernel.org/pub/linux/libs/security/libcap/psx v1.2.71 h1:i19+O6oaKRqgflRO4o7WKdU8LJ7vKNSFLDDqHB6CvQ8=
-kernel.org/pub/linux/libs/security/libcap/psx v1.2.71/go.mod h1:+l6Ee2F59XiJ2I6WR5ObpC1utCQJZ/VLsEbQCD8RG24=
+kernel.org/pub/linux/libs/security/libcap/cap v1.2.72 h1:SqLZbTqwcNxctcdM5yb6OcO3lFJNtRgDJoFeca+5hP0=
+kernel.org/pub/linux/libs/security/libcap/cap v1.2.72/go.mod h1:DqOj+O+b5nV0YW49IVU6WlhVw0oHpC1LmerDRHvcbjE=
+kernel.org/pub/linux/libs/security/libcap/psx v1.2.72 h1:Lnu8woGlvNdwCbBa5urxGO+L5gp647lIZMg0vP+upuU=
+kernel.org/pub/linux/libs/security/libcap/psx v1.2.72/go.mod h1:+l6Ee2F59XiJ2I6WR5ObpC1utCQJZ/VLsEbQCD8RG24=
 rsc.io/qr v0.2.0 h1:6vBLea5/NRMVTz8V66gipeLycZMl/+UlFmk8DvqQ6WY=
 rsc.io/qr v0.2.0/go.mod h1:IF+uZjkb9fqyeF/4tlBoynqmQxUoPfWEKh921coOuXs=
 sigs.k8s.io/hydrophone v0.6.1-0.20240718103601-b92baf7e0b04 h1:K7Vh91tO4gfdp9H7oh4FW+RtzPmk3UXmWFxz8F0hr9Q=
--- a/go.work
+++ b/go.work
@@ -1,4 +1,4 @@
-go 1.23.2
+go 1.23.3

 use (
 	.
--- a/hack/cloud-image-uploader/go.mod
+++ b/hack/cloud-image-uploader/go.mod
@@ -1,6 +1,6 @@
 module github.com/siderolabs/cloud-image-uploader

-go 1.23.2
+go 1.23.3

 require (
 	cloud.google.com/go/storage v1.46.0
@@ -20,14 +20,14 @@ require (
 	github.com/siderolabs/go-pointer v1.0.0
 	github.com/siderolabs/go-retry v0.3.3
 	github.com/spf13/pflag v1.0.5
-	golang.org/x/sync v0.8.0
-	google.golang.org/api v0.204.0
+	golang.org/x/sync v0.9.0
+	google.golang.org/api v0.205.0
 )

 require (
 	cel.dev/expr v0.16.1 // indirect
 	cloud.google.com/go v0.116.0 // indirect
-	cloud.google.com/go/auth v0.10.0 // indirect
+	cloud.google.com/go/auth v0.10.1 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.5 // indirect
 	cloud.google.com/go/compute/metadata v0.5.2 // indirect
 	cloud.google.com/go/iam v1.2.1 // indirect
--- a/hack/cloud-image-uploader/go.sum
+++ b/hack/cloud-image-uploader/go.sum
@@ -3,8 +3,8 @@ cel.dev/expr v0.16.1/go.mod h1:AsGA5zb3WruAEQeQng1RZdGEXmBj0jvMWh6l5SnNuC8=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.116.0 h1:B3fRrSDkLRt5qSHWe40ERJvhvnQwdZiHu0bJOpldweE=
 cloud.google.com/go v0.116.0/go.mod h1:cEPSRWPzZEswwdr9BxE6ChEn01dWlTaF05LiC2Xs70U=
-cloud.google.com/go/auth v0.10.0 h1:tWlkvFAh+wwTOzXIjrwM64karR1iTBZ/GRr0S/DULYo=
-cloud.google.com/go/auth v0.10.0/go.mod h1:xxA5AqpDrvS+Gkmo9RqrGGRh6WSNKKOXhY3zNOr38tI=
+cloud.google.com/go/auth v0.10.1 h1:TnK46qldSfHWt2a0b/hciaiVJsmDXWy9FqyUan0uYiI=
+cloud.google.com/go/auth v0.10.1/go.mod h1:xxA5AqpDrvS+Gkmo9RqrGGRh6WSNKKOXhY3zNOr38tI=
 cloud.google.com/go/auth/oauth2adapt v0.2.5 h1:2p29+dePqsCHPP1bqDJcKj4qxRyYCcbzKpFyKGt3MTk=
 cloud.google.com/go/auth/oauth2adapt v0.2.5/go.mod h1:AlmsELtlEBnaNTL7jCj8VQFLy6mbZv0s4Q7NGBeQ5E8=
 cloud.google.com/go/compute/metadata v0.5.2 h1:UxK4uu/Tn+I3p2dYWTfiX4wva7aYlKixAHn3fyqngqo=
@@ -252,8 +252,8 @@ golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
-golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.9.0 h1:fEo0HyrW1GIgZdpbhCRO0PkJajUS5H9IFUztCgEo2jQ=
+golang.org/x/sync v0.9.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -295,8 +295,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/api v0.204.0 h1:3PjmQQEDkR/ENVZZwIYB4W/KzYtN8OrqnNcHWpeR8E4=
-google.golang.org/api v0.204.0/go.mod h1:69y8QSoKIbL9F94bWgWAq6wGqGwyjBgi2y8rAK8zLag=
+google.golang.org/api v0.205.0 h1:LFaxkAIpDb/GsrWV20dMMo5MR0h8UARTbn24LmD+0Pg=
+google.golang.org/api v0.205.0/go.mod h1:NrK1EMqO8Xk6l6QwRAmrXXg2v6dzukhlOyvkYtnvUuc=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
--- a/hack/docgen/go.mod
+++ b/hack/docgen/go.mod
@@ -1,13 +1,13 @@
 module github.com/siderolabs/talos-hack-docgen

-go 1.23.2
+go 1.23.3

 // forked go-yaml that introduces RawYAML interface, which can be used to populate YAML fields using bytes
 // which are then encoded as a valid YAML blocks with proper indentiation
 replace gopkg.in/yaml.v3 => github.com/unix4ever/yaml v0.0.0-20220527175918-f17b0f05cf2c

 require (
-	github.com/gomarkdown/markdown v0.0.0-20240930133441-72d49d9543d8
+	github.com/gomarkdown/markdown v0.0.0-20241105142532-d03b89096d81
 	github.com/invopop/jsonschema v0.12.0
 	github.com/microcosm-cc/bluemonday v1.0.27
 	github.com/santhosh-tekuri/jsonschema/v5 v5.3.1
--- a/hack/docgen/go.sum
+++ b/hack/docgen/go.sum
@@ -8,8 +8,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI=
 github.com/go-quicktest/qt v1.101.0/go.mod h1:14Bz/f7NwaXPtdYEgzsx46kqSxVwTbzVZsDC26tQJow=
-github.com/gomarkdown/markdown v0.0.0-20240930133441-72d49d9543d8 h1:4txT5G2kqVAKMjzidIabL/8KqjIK71yj30YOeuxLn10=
-github.com/gomarkdown/markdown v0.0.0-20240930133441-72d49d9543d8/go.mod h1:JDGcbDT52eL4fju3sZ4TeHGsQwhG9nbDV21aMyhwPoA=
+github.com/gomarkdown/markdown v0.0.0-20241105142532-d03b89096d81 h1:5lyLWsV+qCkoYqsKUDuycESh9DEIPVKN6iCFeL7ag50=
+github.com/gomarkdown/markdown v0.0.0-20241105142532-d03b89096d81/go.mod h1:JDGcbDT52eL4fju3sZ4TeHGsQwhG9nbDV21aMyhwPoA=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8=
--- a/hack/gotagsrewrite/go.mod
+++ b/hack/gotagsrewrite/go.mod
@@ -1,6 +1,6 @@
 module github.com/siderolabs/gotagsrewrite

-go 1.23.2
+go 1.23.3

 require (
 	github.com/fatih/structtag v1.2.0
--- a/hack/module-sig-verify/go.mod
+++ b/hack/module-sig-verify/go.mod
@@ -1,5 +1,5 @@
 module module-sig-verify

-go 1.23.2
+go 1.23.3

-require go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352
+require go.mozilla.org/pkcs7 v0.9.0
--- a/hack/module-sig-verify/go.sum
+++ b/hack/module-sig-verify/go.sum
@@ -1,2 +1,2 @@
-go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352 h1:CCriYyAfq1Br1aIYettdHZTy8mBTIPo7We18TuO/bak=
-go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352/go.mod h1:SNgMg+EgDFwmvSmLRTNKC5fegJjB7v23qTQ0XLGUNHk=
+go.mozilla.org/pkcs7 v0.9.0 h1:yM4/HS9dYv7ri2biPtxt8ikvB37a980dg69/pKmS+eI=
+go.mozilla.org/pkcs7 v0.9.0/go.mod h1:SNgMg+EgDFwmvSmLRTNKC5fegJjB7v23qTQ0XLGUNHk=
--- a/hack/release.toml
+++ b/hack/release.toml
@@ -18,13 +18,13 @@ preface = """
    [notes.updates]
        title = "Component Updates"
        description = """\
-* Linux: 6.6.59
+* Linux: 6.6.60
 * containerd: 2.0.0
 * Flannel: 0.26.0
 * Kubernetes: 1.32.0-beta.0
 * runc: 1.2.1

-Talos is built with Go 1.23.2.
+Talos is built with Go 1.23.3.
 """

    [notes.usernamespaces]
--- a/hack/structprotogen/go.mod
+++ b/hack/structprotogen/go.mod
@@ -1,17 +1,17 @@
 module github.com/siderolabs/structprotogen

-go 1.23.2
+go 1.23.3

 require (
 	github.com/fatih/structtag v1.2.0
 	github.com/spf13/cobra v1.8.1
-	golang.org/x/tools v0.26.0
-	gopkg.in/typ.v4 v4.3.0
+	golang.org/x/tools v0.27.0
+	gopkg.in/typ.v4 v4.3.1
 )

 require (
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
-	golang.org/x/mod v0.21.0 // indirect
-	golang.org/x/sync v0.8.0 // indirect
+	golang.org/x/mod v0.22.0 // indirect
+	golang.org/x/sync v0.9.0 // indirect
 )
--- a/hack/structprotogen/go.sum
+++ b/hack/structprotogen/go.sum
@@ -8,13 +8,13 @@ github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
 github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-golang.org/x/mod v0.21.0 h1:vvrHzRwRfVKSiLrG+d4FMl/Qi4ukBCE6kZlTUkDYRT0=
-golang.org/x/mod v0.21.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
-golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
-golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/tools v0.26.0 h1:v/60pFQmzmT9ExmjDv2gGIfi3OqfKoEP6I5+umXlbnQ=
-golang.org/x/tools v0.26.0/go.mod h1:TPVVj70c7JJ3WCazhD8OdXcZg/og+b9+tH/KxylGwH0=
+golang.org/x/mod v0.22.0 h1:D4nJWe9zXqHOmWqj4VMOJhvzj7bEZg4wEYa759z1pH4=
+golang.org/x/mod v0.22.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
+golang.org/x/sync v0.9.0 h1:fEo0HyrW1GIgZdpbhCRO0PkJajUS5H9IFUztCgEo2jQ=
+golang.org/x/sync v0.9.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/tools v0.27.0 h1:qEKojBykQkQ4EynWy4S8Weg69NumxKdn40Fce3uc/8o=
+golang.org/x/tools v0.27.0/go.mod h1:sUi0ZgbwW9ZPAq26Ekut+weQPR5eIM6GQLQ1Yjm1H0Q=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/typ.v4 v4.3.0 h1:PEQtVIdhjOo4sOLnqpuEYrfSsul+a85EBGHS7tDJFuU=
-gopkg.in/typ.v4 v4.3.0/go.mod h1:wolXe8DlewxRCjA7SOiT3zjrZ0eQJZcr8cmV6bQWJUM=
+gopkg.in/typ.v4 v4.3.1 h1:z3vGwIIn2X8GjP589+YS8YWmpNqBFEy0w7OcGWj0NZ4=
+gopkg.in/typ.v4 v4.3.1/go.mod h1:wolXe8DlewxRCjA7SOiT3zjrZ0eQJZcr8cmV6bQWJUM=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
--- a/internal/app/apid/pkg/backend/apid_test.go
+++ b/internal/app/apid/pkg/backend/apid_test.go
@@ -260,7 +260,7 @@ func TestAPIIdiosyncrasies(t *testing.T) {
 	}
 }

-//nolint:nakedret,gocyclo,errcheck,forcetypeassert
+//nolint:nakedret,gocyclo,forcetypeassert
 func getOptions(t *testing.T, descriptor protoreflect.Descriptor) (deprecated bool, version string) {
 	switch opts := descriptor.Options().(type) {
 	case *descriptorpb.EnumOptions:
--- a/internal/app/apid/pkg/provider/provider.go
+++ b/internal/app/apid/pkg/provider/provider.go
@@ -58,7 +58,7 @@ func NewTLSConfig(ctx context.Context, resources state.State) (*TLSConfig, error
 			return nil, fmt.Errorf("error watching for API certificates: %w", event.Error)
 		}

-		apiCerts := event.Resource.(*secrets.API) //nolint:errcheck,forcetypeassert
+		apiCerts := event.Resource.(*secrets.API) //nolint:forcetypeassert

 		if err := provider.Update(apiCerts); err != nil {
 			return nil, err
@@ -92,7 +92,7 @@ func (tlsConfig *TLSConfig) Watch(ctx context.Context, onUpdate func()) error {
 			return fmt.Errorf("error watching API certificates: %w", event.Error)
 		}

-		apiCerts := event.Resource.(*secrets.API) //nolint:errcheck,forcetypeassert
+		apiCerts := event.Resource.(*secrets.API) //nolint:forcetypeassert

 		if err := tlsConfig.certificateProvider.Update(apiCerts); err != nil {
 			return fmt.Errorf("failed updating cert: %v", err)
--- a/internal/app/machined/pkg/controllers/k8s/extra_manifest_test.go
+++ b/internal/app/machined/pkg/controllers/k8s/extra_manifest_test.go
@@ -139,7 +139,7 @@ metadata:
 	)
 	suite.Require().NoError(err)

-	manifest := r.(*k8s.Manifest) //nolint:errcheck,forcetypeassert
+	manifest := r.(*k8s.Manifest) //nolint:forcetypeassert

 	suite.Assert().Len(k8sadapter.Manifest(manifest).Objects(), 2)
 	suite.Assert().Equal("ci", k8sadapter.Manifest(manifest).Objects()[0].GetName())
--- a/internal/app/machined/pkg/controllers/k8s/kubeprism_config_test.go
+++ b/internal/app/machined/pkg/controllers/k8s/kubeprism_config_test.go
@@ -75,7 +75,7 @@ func (suite *KubePrismConfigControllerSuite) TestGeneration() {
 	})

 	ctest.UpdateWithConflicts(suite, mc, func(cfg *config.MachineConfig) error {
-		balancer := cfg.Config().Machine().Features().KubePrism().(*v1alpha1.KubePrism) //nolint:errcheck
+		balancer := cfg.Config().Machine().Features().KubePrism().(*v1alpha1.KubePrism)
 		balancer.ServerEnabled = pointer.To(false)

 		return nil
@@ -84,7 +84,7 @@ func (suite *KubePrismConfigControllerSuite) TestGeneration() {
 	ctest.AssertNoResource[*k8s.KubePrismConfig](suite, k8s.KubePrismConfigID)

 	ctest.UpdateWithConflicts(suite, mc, func(cfg *config.MachineConfig) error {
-		balancer := cfg.Config().Machine().Features().KubePrism().(*v1alpha1.KubePrism) //nolint:errcheck
+		balancer := cfg.Config().Machine().Features().KubePrism().(*v1alpha1.KubePrism)
 		balancer.ServerEnabled = pointer.To(true)
 		balancer.ServerPort = 7446

--- a/internal/app/machined/pkg/controllers/k8s/manifest_test.go
+++ b/internal/app/machined/pkg/controllers/k8s/manifest_test.go
@@ -217,14 +217,14 @@ func (suite *ManifestSuite) TestReconcileKubeProxyExtraArgs() {
 	)
 	suite.Require().NoError(err)

-	manifest := r.(*k8s.Manifest) //nolint:errcheck,forcetypeassert
+	manifest := r.(*k8s.Manifest) //nolint:forcetypeassert
 	suite.Assert().Len(k8sadapter.Manifest(manifest).Objects(), 3)

 	suite.Assert().Equal("DaemonSet", k8sadapter.Manifest(manifest).Objects()[0].GetKind())

 	ds := k8sadapter.Manifest(manifest).Objects()[0].Object
 	containerSpec := ds["spec"].(map[string]any)["template"].(map[string]any)["spec"].(map[string]any)["containers"].([]any)[0]
-	args := containerSpec.(map[string]any)["command"].([]any) //nolint:errcheck,forcetypeassert
+	args := containerSpec.(map[string]any)["command"].([]any) //nolint:forcetypeassert

 	suite.Assert().Equal("--bind-address=\"::\"", args[len(args)-1])
 }
@@ -273,7 +273,7 @@ func (suite *ManifestSuite) TestReconcileIPv6() {
 	)
 	suite.Require().NoError(err)

-	manifest := r.(*k8s.Manifest) //nolint:errcheck,forcetypeassert
+	manifest := r.(*k8s.Manifest) //nolint:forcetypeassert
 	suite.Assert().Len(k8sadapter.Manifest(manifest).Objects(), 1)

 	service := k8sadapter.Manifest(manifest).Objects()[0]
@@ -302,7 +302,7 @@ func (suite *ManifestSuite) TestReconcileIPv6() {
 	)
 	suite.Require().NoError(err)

-	manifest = r.(*k8s.Manifest) //nolint:errcheck,forcetypeassert
+	manifest = r.(*k8s.Manifest) //nolint:forcetypeassert
 	suite.Assert().Len(k8sadapter.Manifest(manifest).Objects(), 5)

 	configmap := k8sadapter.Manifest(manifest).Objects()[3]
--- a/internal/app/machined/pkg/controllers/kubeaccess/serviceaccount/crd_controller.go
+++ b/internal/app/machined/pkg/controllers/kubeaccess/serviceaccount/crd_controller.go
@@ -184,8 +184,8 @@ func NewCRDController(
 	if _, err = secrets.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
 		AddFunc: controller.handleSecret,
 		UpdateFunc: func(oldSec, newSec any) {
-			newSecret := newSec.(*corev1.Secret) //nolint:errcheck
-			oldSecret := oldSec.(*corev1.Secret) //nolint:errcheck
+			newSecret := newSec.(*corev1.Secret)
+			oldSecret := oldSec.(*corev1.Secret)

 			if newSecret.ResourceVersion == oldSecret.ResourceVersion {
 				return
--- a/internal/app/machined/pkg/controllers/network/address_merge.go
+++ b/internal/app/machined/pkg/controllers/network/address_merge.go
@@ -75,7 +75,7 @@ func (ctrl *AddressMergeController) Run(ctx context.Context, r controller.Runtim
 		addresses := map[string]*network.AddressSpec{}

 		for _, res := range list.Items {
-			address := res.(*network.AddressSpec) //nolint:errcheck,forcetypeassert
+			address := res.(*network.AddressSpec) //nolint:forcetypeassert
 			id := network.AddressID(address.TypedSpec().LinkName, address.TypedSpec().Address)

 			existing, ok := addresses[id]
--- a/internal/app/machined/pkg/controllers/network/hardware_addr.go
+++ b/internal/app/machined/pkg/controllers/network/hardware_addr.go
@@ -75,7 +75,7 @@ func (ctrl *HardwareAddrController) Run(ctx context.Context, r controller.Runtim
 		}

 		for _, res := range links.Items {
-			link := res.(*network.LinkStatus) //nolint:errcheck,forcetypeassert
+			link := res.(*network.LinkStatus) //nolint:forcetypeassert

 			if !link.TypedSpec().Physical() {
 				continue
--- a/internal/app/machined/pkg/controllers/network/hostname_merge.go
+++ b/internal/app/machined/pkg/controllers/network/hostname_merge.go
@@ -73,7 +73,7 @@ func (ctrl *HostnameMergeController) Run(ctx context.Context, r controller.Runti
 		var final network.HostnameSpecSpec

 		for _, res := range list.Items {
-			spec := res.(*network.HostnameSpec) //nolint:errcheck,forcetypeassert
+			spec := res.(*network.HostnameSpec) //nolint:forcetypeassert

 			if final.Hostname != "" && spec.TypedSpec().ConfigLayer <= final.ConfigLayer {
 				// skip this spec, as existing one is higher layer
--- a/internal/app/machined/pkg/controllers/network/hostname_spec.go
+++ b/internal/app/machined/pkg/controllers/network/hostname_spec.go
@@ -80,7 +80,7 @@ func (ctrl *HostnameSpecController) Run(ctx context.Context, r controller.Runtim

 		// loop over specs and sync to statuses
 		for _, res := range list.Items {
-			spec := res.(*network.HostnameSpec) //nolint:forcetypeassert,errcheck
+			spec := res.(*network.HostnameSpec) //nolint:forcetypeassert

 			switch spec.Metadata().Phase() {
 			case resource.PhaseTearingDown:
--- a/internal/app/machined/pkg/controllers/network/hostname_spec_test.go
+++ b/internal/app/machined/pkg/controllers/network/hostname_spec_test.go
@@ -80,7 +80,7 @@ func (suite *HostnameSpecSuite) assertStatus(id string, fqdn string) error {
 		return err
 	}

-	status := r.(*network.HostnameStatus) //nolint:errcheck,forcetypeassert
+	status := r.(*network.HostnameStatus) //nolint:forcetypeassert

 	if status.TypedSpec().FQDN() != fqdn {
 		return retry.ExpectedErrorf("fqdn mismatch: %q != %q", status.TypedSpec().FQDN(), fqdn)
--- a/internal/app/machined/pkg/controllers/network/link_config.go
+++ b/internal/app/machined/pkg/controllers/network/link_config.go
@@ -184,7 +184,7 @@ func (ctrl *LinkConfigController) Run(ctx context.Context, r controller.Runtime,
 		}

 		for _, item := range list.Items {
-			linkStatus := item.(*network.LinkStatus) //nolint:errcheck,forcetypeassert
+			linkStatus := item.(*network.LinkStatus) //nolint:forcetypeassert

 			if _, configured := configuredLinks[linkStatus.Metadata().ID()]; !configured {
 				if linkStatus.TypedSpec().Physical() {
--- a/internal/app/machined/pkg/controllers/network/link_merge.go
+++ b/internal/app/machined/pkg/controllers/network/link_merge.go
@@ -72,8 +72,8 @@ func (ctrl *LinkMergeController) Run(ctx context.Context, r controller.Runtime,

 		// sort by link name, configuration layer
 		sort.Slice(list.Items, func(i, j int) bool {
-			left := list.Items[i].(*network.LinkSpec)  //nolint:errcheck,forcetypeassert
-			right := list.Items[j].(*network.LinkSpec) //nolint:errcheck,forcetypeassert
+			left := list.Items[i].(*network.LinkSpec)  //nolint:forcetypeassert
+			right := list.Items[j].(*network.LinkSpec) //nolint:forcetypeassert

 			if left.TypedSpec().Name < right.TypedSpec().Name {
 				return false
@@ -90,7 +90,7 @@ func (ctrl *LinkMergeController) Run(ctx context.Context, r controller.Runtime,
 		links := map[string]*network.LinkSpecSpec{}

 		for _, res := range list.Items {
-			link := res.(*network.LinkSpec) //nolint:errcheck,forcetypeassert
+			link := res.(*network.LinkSpec) //nolint:forcetypeassert
 			id := network.LinkID(link.TypedSpec().Name)

 			existing, ok := links[id]
--- a/internal/app/machined/pkg/controllers/network/node_address.go
+++ b/internal/app/machined/pkg/controllers/network/node_address.go
@@ -85,7 +85,7 @@ func (ctrl *NodeAddressController) Run(ctx context.Context, r controller.Runtime
 		linksUp := make(map[uint32]struct{})

 		for _, r := range links.Items {
-			link := r.(*network.LinkStatus) //nolint:errcheck,forcetypeassert
+			link := r.(*network.LinkStatus) //nolint:forcetypeassert

 			if link.TypedSpec().OperationalState == nethelpers.OperStateUp || link.TypedSpec().OperationalState == nethelpers.OperStateUnknown {
 				// skip physical interfaces without carrier
@@ -115,7 +115,7 @@ func (ctrl *NodeAddressController) Run(ctx context.Context, r controller.Runtime
 		)

 		for _, r := range addresses.Items {
-			addr := r.(*network.AddressStatus) //nolint:errcheck,forcetypeassert
+			addr := r.(*network.AddressStatus) //nolint:forcetypeassert

 			if addr.TypedSpec().Scope >= nethelpers.ScopeLink {
 				continue
--- a/internal/app/machined/pkg/controllers/network/operator/vip.go
+++ b/internal/app/machined/pkg/controllers/network/operator/vip.go
@@ -159,7 +159,7 @@ func (vip *VIP) waitForPreconditions(ctx context.Context) error {
 				return false, nil
 			}

-			svc := r.(*v1alpha1.Service) //nolint:errcheck,forcetypeassert
+			svc := r.(*v1alpha1.Service) //nolint:forcetypeassert

 			return svc.TypedSpec().Running && svc.TypedSpec().Healthy, nil
 		}))
--- a/internal/app/machined/pkg/controllers/network/operator_config.go
+++ b/internal/app/machined/pkg/controllers/network/operator_config.go
@@ -238,7 +238,7 @@ func (ctrl *OperatorConfigController) Run(ctx context.Context, r controller.Runt
 		}

 		for _, item := range list.Items {
-			linkStatus := item.(*network.LinkStatus) //nolint:errcheck,forcetypeassert
+			linkStatus := item.(*network.LinkStatus) //nolint:forcetypeassert

 			if linkStatus.TypedSpec().Physical() {
 				if _, configured := configuredInterfaces[linkStatus.Metadata().ID()]; !configured {
--- a/internal/app/machined/pkg/controllers/network/operator_merge.go
+++ b/internal/app/machined/pkg/controllers/network/operator_merge.go
@@ -75,7 +75,7 @@ func (ctrl *OperatorMergeController) Run(ctx context.Context, r controller.Runti
 		operators := map[string]*network.OperatorSpec{}

 		for _, res := range list.Items {
-			operator := res.(*network.OperatorSpec) //nolint:errcheck,forcetypeassert
+			operator := res.(*network.OperatorSpec) //nolint:forcetypeassert
 			id := network.OperatorID(operator.TypedSpec().Operator, operator.TypedSpec().LinkName)

 			existing, ok := operators[id]
--- a/internal/app/machined/pkg/controllers/network/operator_spec.go
+++ b/internal/app/machined/pkg/controllers/network/operator_spec.go
@@ -194,7 +194,7 @@ func (ctrl *OperatorSpecController) reconcileOperators(ctx context.Context, r co
 	}

 	for _, item := range list.Items {
-		linkStatus := item.(*network.LinkStatus) //nolint:errcheck,forcetypeassert
+		linkStatus := item.(*network.LinkStatus) //nolint:forcetypeassert

 		linkStatuses[linkStatus.Metadata().ID()] = linkStatus.TypedSpec().OperationalState == nethelpers.OperStateUnknown || linkStatus.TypedSpec().OperationalState == nethelpers.OperStateUp
 	}
@@ -209,7 +209,7 @@ func (ctrl *OperatorSpecController) reconcileOperators(ctx context.Context, r co
 	shouldRun := make(map[string]*network.OperatorSpecSpec)

 	for _, item := range list.Items {
-		operatorSpec := item.(*network.OperatorSpec) //nolint:errcheck,forcetypeassert
+		operatorSpec := item.(*network.OperatorSpec) //nolint:forcetypeassert

 		up, exists := linkStatuses[operatorSpec.TypedSpec().LinkName]

--- a/internal/app/machined/pkg/controllers/network/platform_config.go
+++ b/internal/app/machined/pkg/controllers/network/platform_config.go
@@ -229,7 +229,7 @@ func (ctrl *PlatformConfigController) apply(ctx context.Context, r controller.Ru
 				return networkConfig.Addresses[i]
 			},
 			idBuilder: func(spec any) (resource.ID, error) {
-				addressSpec := spec.(network.AddressSpecSpec) //nolint:errcheck,forcetypeassert
+				addressSpec := spec.(network.AddressSpecSpec) //nolint:forcetypeassert

 				return network.LayeredID(network.ConfigPlatform, network.AddressID(addressSpec.LinkName, addressSpec.Address)), nil
 			},
@@ -240,7 +240,7 @@ func (ctrl *PlatformConfigController) apply(ctx context.Context, r controller.Ru
 				return func(r resource.Resource) error {
 					spec := r.(*network.AddressSpec).TypedSpec()

-					*spec = newSpec.(network.AddressSpecSpec) //nolint:errcheck,forcetypeassert
+					*spec = newSpec.(network.AddressSpecSpec) //nolint:forcetypeassert
 					spec.ConfigLayer = network.ConfigPlatform

 					return nil
@@ -254,7 +254,7 @@ func (ctrl *PlatformConfigController) apply(ctx context.Context, r controller.Ru
 				return networkConfig.Links[i]
 			},
 			idBuilder: func(spec any) (resource.ID, error) {
-				linkSpec := spec.(network.LinkSpecSpec) //nolint:errcheck,forcetypeassert
+				linkSpec := spec.(network.LinkSpecSpec) //nolint:forcetypeassert

 				return network.LayeredID(network.ConfigPlatform, network.LinkID(linkSpec.Name)), nil
 			},
@@ -265,7 +265,7 @@ func (ctrl *PlatformConfigController) apply(ctx context.Context, r controller.Ru
 				return func(r resource.Resource) error {
 					spec := r.(*network.LinkSpec).TypedSpec()

-					*spec = newSpec.(network.LinkSpecSpec) //nolint:errcheck,forcetypeassert
+					*spec = newSpec.(network.LinkSpecSpec) //nolint:forcetypeassert
 					spec.ConfigLayer = network.ConfigPlatform

 					return nil
@@ -279,7 +279,7 @@ func (ctrl *PlatformConfigController) apply(ctx context.Context, r controller.Ru
 				return networkConfig.Routes[i]
 			},
 			idBuilder: func(spec any) (resource.ID, error) {
-				routeSpec := spec.(network.RouteSpecSpec) //nolint:errcheck,forcetypeassert
+				routeSpec := spec.(network.RouteSpecSpec) //nolint:forcetypeassert

 				return network.LayeredID(
 					network.ConfigPlatform,
@@ -293,7 +293,7 @@ func (ctrl *PlatformConfigController) apply(ctx context.Context, r controller.Ru
 				return func(r resource.Resource) error {
 					spec := r.(*network.RouteSpec).TypedSpec()

-					*spec = newSpec.(network.RouteSpecSpec) //nolint:errcheck,forcetypeassert
+					*spec = newSpec.(network.RouteSpecSpec) //nolint:forcetypeassert
 					spec.ConfigLayer = network.ConfigPlatform

 					return nil
@@ -316,7 +316,7 @@ func (ctrl *PlatformConfigController) apply(ctx context.Context, r controller.Ru
 				return func(r resource.Resource) error {
 					spec := r.(*network.HostnameSpec).TypedSpec()

-					*spec = newSpec.(network.HostnameSpecSpec) //nolint:errcheck,forcetypeassert
+					*spec = newSpec.(network.HostnameSpecSpec) //nolint:forcetypeassert
 					spec.ConfigLayer = network.ConfigPlatform

 					return nil
@@ -339,7 +339,7 @@ func (ctrl *PlatformConfigController) apply(ctx context.Context, r controller.Ru
 				return func(r resource.Resource) error {
 					spec := r.(*network.ResolverSpec).TypedSpec()

-					*spec = newSpec.(network.ResolverSpecSpec) //nolint:errcheck,forcetypeassert
+					*spec = newSpec.(network.ResolverSpecSpec) //nolint:forcetypeassert
 					spec.ConfigLayer = network.ConfigPlatform

 					return nil
@@ -362,7 +362,7 @@ func (ctrl *PlatformConfigController) apply(ctx context.Context, r controller.Ru
 				return func(r resource.Resource) error {
 					spec := r.(*network.TimeServerSpec).TypedSpec()

-					*spec = newSpec.(network.TimeServerSpecSpec) //nolint:errcheck,forcetypeassert
+					*spec = newSpec.(network.TimeServerSpecSpec) //nolint:forcetypeassert
 					spec.ConfigLayer = network.ConfigPlatform

 					return nil
@@ -376,7 +376,7 @@ func (ctrl *PlatformConfigController) apply(ctx context.Context, r controller.Ru
 				return networkConfig.Operators[i]
 			},
 			idBuilder: func(spec any) (resource.ID, error) {
-				operatorSpec := spec.(network.OperatorSpecSpec) //nolint:errcheck,forcetypeassert
+				operatorSpec := spec.(network.OperatorSpecSpec) //nolint:forcetypeassert

 				return network.LayeredID(network.ConfigPlatform, network.OperatorID(operatorSpec.Operator, operatorSpec.LinkName)), nil
 			},
@@ -387,7 +387,7 @@ func (ctrl *PlatformConfigController) apply(ctx context.Context, r controller.Ru
 				return func(r resource.Resource) error {
 					spec := r.(*network.OperatorSpec).TypedSpec()

-					*spec = newSpec.(network.OperatorSpecSpec) //nolint:errcheck,forcetypeassert
+					*spec = newSpec.(network.OperatorSpecSpec) //nolint:forcetypeassert
 					spec.ConfigLayer = network.ConfigPlatform

 					return nil
@@ -401,7 +401,7 @@ func (ctrl *PlatformConfigController) apply(ctx context.Context, r controller.Ru
 				return networkConfig.ExternalIPs[i]
 			},
 			idBuilder: func(spec any) (resource.ID, error) {
-				ipAddr := spec.(netip.Addr) //nolint:errcheck,forcetypeassert
+				ipAddr := spec.(netip.Addr) //nolint:forcetypeassert
 				ipPrefix := netip.PrefixFrom(ipAddr, ipAddr.BitLen())

 				return network.AddressID(externalLink, ipPrefix), nil
@@ -411,7 +411,7 @@ func (ctrl *PlatformConfigController) apply(ctx context.Context, r controller.Ru
 			},
 			resourceModifier: func(newSpec any) func(r resource.Resource) error {
 				return func(r resource.Resource) error {
-					ipAddr := newSpec.(netip.Addr) //nolint:errcheck,forcetypeassert
+					ipAddr := newSpec.(netip.Addr) //nolint:forcetypeassert
 					ipPrefix := netip.PrefixFrom(ipAddr, ipAddr.BitLen())

 					status := r.(*network.AddressStatus).TypedSpec()
@@ -438,7 +438,7 @@ func (ctrl *PlatformConfigController) apply(ctx context.Context, r controller.Ru
 				return networkConfig.Probes[i]
 			},
 			idBuilder: func(spec any) (resource.ID, error) {
-				probeSpec := spec.(network.ProbeSpecSpec) //nolint:errcheck,forcetypeassert
+				probeSpec := spec.(network.ProbeSpecSpec) //nolint:forcetypeassert

 				return probeSpec.ID()
 			},
@@ -449,7 +449,7 @@ func (ctrl *PlatformConfigController) apply(ctx context.Context, r controller.Ru
 				return func(r resource.Resource) error {
 					spec := r.(*network.ProbeSpec).TypedSpec()

-					*spec = newSpec.(network.ProbeSpecSpec) //nolint:errcheck,forcetypeassert
+					*spec = newSpec.(network.ProbeSpecSpec) //nolint:forcetypeassert
 					spec.ConfigLayer = network.ConfigPlatform

 					return nil
@@ -470,7 +470,7 @@ func (ctrl *PlatformConfigController) apply(ctx context.Context, r controller.Ru
 			},
 			resourceModifier: func(newSpec any) func(r resource.Resource) error {
 				return func(r resource.Resource) error {
-					metadata := newSpec.(*runtimeres.PlatformMetadataSpec) //nolint:errcheck,forcetypeassert
+					metadata := newSpec.(*runtimeres.PlatformMetadataSpec) //nolint:forcetypeassert

 					*r.(*runtimeres.PlatformMetadata).TypedSpec() = *metadata

--- a/internal/app/machined/pkg/controllers/network/resolver_spec_test.go
+++ b/internal/app/machined/pkg/controllers/network/resolver_spec_test.go
@@ -77,7 +77,7 @@ func (suite *ResolverSpecSuite) assertStatus(id string, servers ...netip.Addr) e
 		return err
 	}

-	status := r.(*network.ResolverStatus) //nolint:errcheck,forcetypeassert
+	status := r.(*network.ResolverStatus) //nolint:forcetypeassert

 	if !slices.Equal(status.TypedSpec().DNSServers, servers) {
 		return retry.ExpectedErrorf("server list mismatch: %q != %q", status.TypedSpec().DNSServers, servers)
--- a/internal/app/machined/pkg/controllers/network/route_merge.go
+++ b/internal/app/machined/pkg/controllers/network/route_merge.go
@@ -73,7 +73,7 @@ func (ctrl *RouteMergeController) Run(ctx context.Context, r controller.Runtime,
 		routes := map[string]*network.RouteSpec{}

 		for _, res := range list.Items {
-			route := res.(*network.RouteSpec) //nolint:errcheck,forcetypeassert
+			route := res.(*network.RouteSpec) //nolint:forcetypeassert
 			id := network.RouteID(route.TypedSpec().Table, route.TypedSpec().Family, route.TypedSpec().Destination, route.TypedSpec().Gateway, route.TypedSpec().Priority, route.TypedSpec().OutLinkName)

 			existing, ok := routes[id]
--- a/internal/app/machined/pkg/controllers/network/route_spec.go
+++ b/internal/app/machined/pkg/controllers/network/route_spec.go
@@ -105,7 +105,7 @@ func (ctrl *RouteSpecController) Run(ctx context.Context, r controller.Runtime,

 		// loop over routes and make reconcile decision
 		for _, res := range list.Items {
-			route := res.(*network.RouteSpec) //nolint:forcetypeassert,errcheck
+			route := res.(*network.RouteSpec) //nolint:forcetypeassert

 			if err = ctrl.syncRoute(ctx, r, logger, conn, links, routes, route); err != nil {
 				multiErr = multierror.Append(multiErr, err)
--- a/internal/app/machined/pkg/controllers/network/timeserver_merge.go
+++ b/internal/app/machined/pkg/controllers/network/timeserver_merge.go
@@ -73,7 +73,7 @@ func (ctrl *TimeServerMergeController) Run(ctx context.Context, r controller.Run
 		var final network.TimeServerSpecSpec

 		for _, res := range list.Items {
-			spec := res.(*network.TimeServerSpec) //nolint:errcheck,forcetypeassert
+			spec := res.(*network.TimeServerSpec) //nolint:forcetypeassert

 			if final.NTPServers != nil && spec.TypedSpec().ConfigLayer < final.ConfigLayer {
 				// skip this spec, as existing one is higher layer
--- a/internal/app/machined/pkg/controllers/network/timeserver_spec.go
+++ b/internal/app/machined/pkg/controllers/network/timeserver_spec.go
@@ -78,7 +78,7 @@ func (ctrl *TimeServerSpecController) Run(ctx context.Context, r controller.Runt

 		// loop over specs and sync to statuses
 		for _, res := range list.Items {
-			spec := res.(*network.TimeServerSpec) //nolint:forcetypeassert,errcheck
+			spec := res.(*network.TimeServerSpec) //nolint:forcetypeassert

 			switch spec.Metadata().Phase() {
 			case resource.PhaseTearingDown:
--- a/internal/app/machined/pkg/controllers/network/timeserver_spec_test.go
+++ b/internal/app/machined/pkg/controllers/network/timeserver_spec_test.go
@@ -76,7 +76,7 @@ func (suite *TimeServerSpecSuite) assertStatus(id string, servers ...string) err
 		return err
 	}

-	status := r.(*network.TimeServerStatus) //nolint:errcheck,forcetypeassert
+	status := r.(*network.TimeServerStatus) //nolint:forcetypeassert

 	if !slices.Equal(status.TypedSpec().NTPServers, servers) {
 		return retry.ExpectedErrorf("server list mismatch: %q != %q", status.TypedSpec().NTPServers, servers)
--- a/internal/app/machined/pkg/controllers/time/sync_test.go
+++ b/internal/app/machined/pkg/controllers/time/sync_test.go
@@ -92,7 +92,7 @@ func (suite *SyncSuite) assertTimeStatus(spec timeresource.StatusSpec) error {
 		return err
 	}

-	status := r.(*timeresource.Status) //nolint:errcheck,forcetypeassert
+	status := r.(*timeresource.Status) //nolint:forcetypeassert

 	if *status.TypedSpec() != spec {
 		return retry.ExpectedErrorf("time status doesn't match: %v != %v", *status.TypedSpec(), spec)
--- a/internal/app/machined/pkg/system/services/etcd.go
+++ b/internal/app/machined/pkg/system/services/etcd.go
@@ -605,7 +605,7 @@ func promoteMember(ctx context.Context, r runtime.Runtime, memberID uint64) erro
 		}

 		// try to iterate all available endpoints in the time available for an attempt
-		for range len(endpoints) {
+		for range endpoints {
 			select {
 			case <-ctx.Done():
 				return retry.ExpectedError(ctx.Err())
--- a/internal/app/trustd/internal/provider/provider.go
+++ b/internal/app/trustd/internal/provider/provider.go
@@ -60,7 +60,7 @@ func NewTLSConfig(ctx context.Context, resources state.State) (*TLSConfig, error
 			return nil, fmt.Errorf("error watching for trustd certificates: %w", event.Error)
 		}

-		trustdCerts := event.Resource.(*secrets.Trustd) //nolint:errcheck,forcetypeassert
+		trustdCerts := event.Resource.(*secrets.Trustd) //nolint:forcetypeassert

 		if err := provider.Update(trustdCerts); err != nil {
 			return nil, err
@@ -94,7 +94,7 @@ func (tlsConfig *TLSConfig) Watch(ctx context.Context) error {
 			log.Printf("error watching for trustd certificates: %s", event.Error)
 		}

-		trustdCerts := event.Resource.(*secrets.Trustd) //nolint:errcheck,forcetypeassert
+		trustdCerts := event.Resource.(*secrets.Trustd) //nolint:forcetypeassert

 		if err := tlsConfig.certificateProvider.Update(trustdCerts); err != nil {
 			return fmt.Errorf("failed updating cert: %w", err)
--- a/internal/integration/api/reboot.go
+++ b/internal/integration/api/reboot.go
@@ -166,7 +166,7 @@ func (suite *RebootSuite) TestRebootAllNodes() {
 					return fmt.Errorf("bootID record not found for %q", node)
 				}

-				bootIDBefore := bootIDBeforeInterface.(string) //nolint:errcheck,forcetypeassert
+				bootIDBefore := bootIDBeforeInterface.(string) //nolint:forcetypeassert

 				nodeCtx := client.WithNodes(suite.ctx, node)

--- a/internal/integration/k8s/constants.go
+++ b/internal/integration/k8s/constants.go
@@ -10,7 +10,7 @@ package k8s
 const (
 	// RookCephHelmChartVersion is the version of the Rook Ceph Helm chart to use.
 	// renovate: datasource=helm versioning=helm depName=rook-ceph registryUrl=https://charts.rook.io/release
-	RookCephHelmChartVersion = "v1.15.4"
+	RookCephHelmChartVersion = "v1.15.5"
 	// LongHornHelmChartVersion is the version of the Longhorn Helm chart to use.
 	// renovate: datasource=helm versioning=helm depName=longhorn registryUrl=https://charts.longhorn.io
 	LongHornHelmChartVersion = "v1.7.2"
--- a/pkg/chunker/chunker.go
+++ b/pkg/chunker/chunker.go
@@ -5,9 +5,7 @@
 package chunker

 // Chunker is an interface for embedding all chunking interfaces under one name.
-type Chunker interface {
-	ChunkReader
-}
+type Chunker = ChunkReader

 // ChunkReader is an interface describing a reader that streams data in []byte
 // chunks.
--- a/pkg/imager/profile/internal/signer/aws/pcr.go
+++ b/pkg/imager/profile/internal/signer/aws/pcr.go
@@ -132,7 +132,7 @@ func NewPCRSigner(ctx context.Context, kmsKeyID, awsRegion string) (*KeySigner,
 		return nil, fmt.Errorf("Public key is not valid: %w", err)
 	}

-	rsaKey := parsedKey.(*rsa.PublicKey) //nolint:errcheck
+	rsaKey := parsedKey.(*rsa.PublicKey)
 	if rsaKey.E == 0 {
 		return nil, fmt.Errorf("property e is empty")
 	}
--- a/pkg/machinery/config/config/cluster.go
+++ b/pkg/machinery/config/config/cluster.go
@@ -201,6 +201,8 @@ type DiscoveryRegistries interface {
 }

 // KubernetesRegistry describes Kubernetes discovery registry.
+//
+//nolint:iface
 type KubernetesRegistry interface {
 	Enabled() bool
 }
--- a/pkg/machinery/config/config/machine.go
+++ b/pkg/machinery/config/config/machine.go
@@ -123,12 +123,16 @@ type MachineControlPlane interface {

 // MachineControllerManager defines the requirements for a config that pertains to ControllerManager
 // related options.
+//
+//nolint:iface
 type MachineControllerManager interface {
 	Disabled() bool
 }

 // MachineScheduler defines the requirements for a config that pertains to Scheduler
 // related options.
+//
+//nolint:iface
 type MachineScheduler interface {
 	Disabled() bool
 }
@@ -187,11 +191,15 @@ type VIPConfig interface {
 }

 // VIPEquinixMetal contains Equinix Metal API VIP settings.
+//
+//nolint:iface
 type VIPEquinixMetal interface {
 	APIToken() string
 }

 // VIPHCloud contains Hetzner Cloud API VIP settings.
+//
+//nolint:iface
 type VIPHCloud interface {
 	APIToken() string
 }
@@ -248,6 +256,8 @@ type Bond interface {
 }

 // STP contains the Spanning Tree Protocol settings for a bridge.
+//
+//nolint:iface
 type STP interface {
 	Enabled() bool
 }
--- a/pkg/machinery/config/configloader/internal/decoder/decoder_test.go
+++ b/pkg/machinery/config/configloader/internal/decoder/decoder_test.go
@@ -350,7 +350,7 @@ func TestDecoderV1Alpha1Config(t *testing.T) {
 func TestDoubleV1Alpha1(t *testing.T) {
 	t.Parallel()

-	files := os.DirFS("testdata/double").(fs.ReadFileFS) //nolint:errcheck
+	files := os.DirFS("testdata/double").(fs.ReadFileFS)
 	contents := must.Value(files.ReadFile("v1alpha1.yaml"))(t)

 	d := decoder.NewDecoder()
--- a/pkg/machinery/config/types/v1alpha1/v1alpha1_unstructured.go
+++ b/pkg/machinery/config/types/v1alpha1/v1alpha1_unstructured.go
@@ -25,7 +25,7 @@ func (in *Unstructured) DeepCopy() *Unstructured {

 	out := new(Unstructured)

-	out.Object = deepCopyUnstructured(in.Object).(map[string]any) //nolint:errcheck,forcetypeassert
+	out.Object = deepCopyUnstructured(in.Object).(map[string]any) //nolint:forcetypeassert

 	return out
 }
--- a/pkg/machinery/constants/constants.go
+++ b/pkg/machinery/constants/constants.go
@@ -14,7 +14,7 @@ import (

 const (
 	// DefaultKernelVersion is the default Linux kernel version.
-	DefaultKernelVersion = "6.6.59-talos"
+	DefaultKernelVersion = "6.6.60-talos"

 	// KernelModulesPath is the default path to the kernel modules without the kernel version.
 	KernelModulesPath = "/lib/modules"
@@ -1052,7 +1052,7 @@ const (
 	DBusClientSocketLabel = "system_u:object_r:dbus_client_socket_t:s0"

 	// GoVersion is the version of Go compiler this release was built with.
-	GoVersion = "go1.23.2"
+	GoVersion = "go1.23.3"

 	// KubernetesTalosAPIServiceName is the name of the Kubernetes service to access Talos API.
 	KubernetesTalosAPIServiceName = "talos"
--- a/pkg/machinery/gendata/data/extras
+++ b/pkg/machinery/gendata/data/extras
@@ -1 +1 @@
-v1.9.0-alpha.0-1-geab6e58
+v1.9.0-alpha.0-2-g78ba66b
--- a/pkg/machinery/gendata/data/pkgs
+++ b/pkg/machinery/gendata/data/pkgs
@@ -1 +1 @@
-v1.9.0-alpha.0-37-g4699763
+v1.9.0-alpha.0-40-g567a14a
--- a/pkg/machinery/go.mod
+++ b/pkg/machinery/go.mod
@@ -1,6 +1,6 @@
 module github.com/siderolabs/talos/pkg/machinery

-go 1.23.2
+go 1.23.3

 // forked go-yaml that introduces RawYAML interface, which can be used to populate YAML fields using bytes
 // which are then encoded as a valid YAML blocks with proper indentiation
@@ -15,13 +15,13 @@ require (
 	github.com/evanphx/json-patch v5.9.0+incompatible
 	github.com/fatih/color v1.18.0
 	github.com/ghodss/yaml v1.0.0
-	github.com/google/cel-go v0.21.0
+	github.com/google/cel-go v0.22.0
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/hexops/gotextdiff v1.0.3
 	github.com/jsimonetti/rtnetlink/v2 v2.0.2
 	github.com/mdlayher/ethtool v0.2.0
 	github.com/opencontainers/runtime-spec v1.2.0
-	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10
+	github.com/planetscale/vtprotobuf v0.6.1-0.20240917153116-6f2963f01587
 	github.com/ryanuber/go-glob v1.0.0
 	github.com/santhosh-tekuri/jsonschema/v5 v5.3.1
 	github.com/siderolabs/crypto v0.5.0
@@ -35,12 +35,13 @@ require (
 	go.uber.org/zap v1.27.0
 	google.golang.org/genproto/googleapis/api v0.0.0-20241104194629-dd2ea8efbc28
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20241104194629-dd2ea8efbc28
-	google.golang.org/grpc v1.67.1 // do not update to 1.68.0 until we find a way around https://github.com/grpc/grpc-go/pull/7535
+	google.golang.org/grpc v1.68.0
 	google.golang.org/protobuf v1.35.1
 	gopkg.in/yaml.v3 v3.0.1
 )

 require (
+	cel.dev/expr v0.18.0 // indirect
 	github.com/ProtonMail/go-crypto v1.1.0-alpha.5.0.20240827111422-b5837fa4476e // indirect
 	github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f // indirect
 	github.com/ProtonMail/gopenpgp/v2 v2.7.5 // indirect
--- a/pkg/machinery/go.sum
+++ b/pkg/machinery/go.sum
@@ -1,3 +1,5 @@
+cel.dev/expr v0.18.0 h1:CJ6drgk+Hf96lkLikr4rFf19WrU0BOWEihyZnI2TAzo=
+cel.dev/expr v0.18.0/go.mod h1:MrpN08Q+lEBs+bGYdLxxHkZoUSsCp0nSKTs0nTymJgw=
 github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
 github.com/ProtonMail/go-crypto v1.1.0-alpha.5.0.20240827111422-b5837fa4476e h1:O1cSHAcGcbGEO66Qi2AIJeYmXO8iP4L/PNrbdN+RjJA=
 github.com/ProtonMail/go-crypto v1.1.0-alpha.5.0.20240827111422-b5837fa4476e/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
@@ -47,8 +49,10 @@ github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
 github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
-github.com/google/cel-go v0.21.0 h1:cl6uW/gxN+Hy50tNYvI691+sXxioCnstFzLp2WO4GCI=
-github.com/google/cel-go v0.21.0/go.mod h1:rHUlWCcBKgyEk+eV03RPdZUekPp6YcJwV0FxuUksYxc=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/cel-go v0.22.0 h1:b3FJZxpiv1vTMo2/5RDUqAHPxkT8mmMfJIrq1llbf7g=
+github.com/google/cel-go v0.22.0/go.mod h1:BuznPXXfQDpXKWQ9sPW3TzlAJN5zzFe+i9tIs0yC4s8=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/pprof v0.0.0-20240424215950-a892ee059fd6 h1:k7nVchz72niMH6YLQNvHSdIE7iqsQxK1P41mySCvssg=
@@ -93,8 +97,8 @@ github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmd
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo=
-github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
+github.com/planetscale/vtprotobuf v0.6.1-0.20240917153116-6f2963f01587 h1:xzZOeCMQLA/W198ZkdVdt4EKFKJtS26B773zNU377ZY=
+github.com/planetscale/vtprotobuf v0.6.1-0.20240917153116-6f2963f01587/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
@@ -201,8 +205,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20241104194629-dd2ea8efbc28 h1:
 google.golang.org/genproto/googleapis/api v0.0.0-20241104194629-dd2ea8efbc28/go.mod h1:dguCy7UOdZhTvLzDyt15+rOrawrpM4q7DD9dQ1P11P4=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20241104194629-dd2ea8efbc28 h1:XVhgTWWV3kGQlwJHR3upFWZeTsei6Oks1apkZSeonIE=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20241104194629-dd2ea8efbc28/go.mod h1:GX3210XPVPUjJbTUbvwI8f2IpZDMZuPJWDzDuebbviI=
-google.golang.org/grpc v1.67.1 h1:zWnc1Vrcno+lHZCOofnIMvycFcc0QRGIzm9dhnDX68E=
-google.golang.org/grpc v1.67.1/go.mod h1:1gLDyUQU7CTLJI90u3nXZ9ekeghjeM7pTDZlqFNg2AA=
+google.golang.org/grpc v1.68.0 h1:aHQeeJbo8zAkAa3pRzrVjZlbz6uSfeOXlJNQM0RAbz0=
+google.golang.org/grpc v1.68.0/go.mod h1:fmSPC5AsjSBCK54MyHRx48kpOti1/jRfOlwEWywNjWA=
 google.golang.org/protobuf v1.35.1 h1:m3LfL6/Ca+fqnjnlqQXNpFPABW1UD7mjh8KO2mKFytA=
 google.golang.org/protobuf v1.35.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=