--- a/go.mod
+++ b/go.mod
@@ -117,17 +117,17 @@
 	go.uber.org/zap v1.28.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.52.0 // indirect
+	golang.org/x/crypto v0.53.0 // indirect
 	golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa // indirect
-	golang.org/x/mod v0.36.0 // indirect
-	golang.org/x/net v0.55.0 // indirect
+	golang.org/x/mod v0.37.0 // indirect
+	golang.org/x/net v0.57.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
-	golang.org/x/term v0.43.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
+	golang.org/x/sync v0.21.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/term v0.45.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
-	golang.org/x/tools v0.45.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
@@ -214,3 +214,13 @@
 replace k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.36.1
 
 replace k8s.io/streaming => k8s.io/streaming v0.36.1
+
+replace github.com/google/cel-go => github.com/google/cel-go v0.29.0
+
+replace golang.org/x/crypto => golang.org/x/crypto v0.56.0
+
+replace golang.org/x/net => golang.org/x/net v0.56.0
+
+replace golang.org/x/text => golang.org/x/text v0.39.0
+
+replace google.golang.org/grpc => google.golang.org/grpc v1.83.1
--- a/go.sum
+++ b/go.sum
@@ -106,10 +106,11 @@
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
 github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
-github.com/google/cel-go v0.27.0 h1:e7ih85+4qVrBuqQWTW4FKSqZYokVuc3HnhH5keboFTo=
-github.com/google/cel-go v0.27.0/go.mod h1:tTJ11FWqnhw5KKpnWpvW9CJC3Y9GK4EIS0WXnBbebzw=
+github.com/google/cel-go v0.29.0 h1:fEG+Ja3YRwNOqnQxTyJwoByAUAvTuxUGiro/jhrm4F4=
+github.com/google/cel-go v0.29.0/go.mod h1:X0bD6iVNR8pkROSOoHVdgTkzmRcosof7WQqCD6wcMc8=
 github.com/google/gnostic-models v0.7.1 h1:SisTfuFKJSKM5CPZkffwi6coztzzeYUhc3v4yxLWH8c=
 github.com/google/gnostic-models v0.7.1/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -225,6 +226,7 @@
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo=
 go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E=
 go.etcd.io/etcd/api/v3 v3.6.11 h1:XFGTgrJ8nak3kB4NgMG8t7NT+lEeuuvKQAqUHKVgkWQ=
@@ -273,57 +275,108 @@
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
-golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
+golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
+golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
 golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa h1:Zt3DZoOFFYkKhDT3v7Lm9FDMEV06GpzjG2jrqW+QTE0=
 golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa/go.mod h1:K79w1Vqn7PoiZn+TkNpx3BUWUQksGO3JcVX6qIjytmA=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+golang.org/x/mod v0.26.0/go.mod h1:/j6NAhSk8iQ723BGAUyoAcn7SlD7s15Dp9Nd/SfeaFQ=
+golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
+golang.org/x/mod v0.28.0/go.mod h1:yfB/L0NOf/kmEbXjzCPOx1iK1fRutOydrCMsqRhEBxI=
+golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w=
+golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc=
+golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
+golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU=
+golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
+golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
+golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
 golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
-golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
-golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
-golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
-golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/telemetry v0.0.0-20240521205824-bda55230c457/go.mod h1:pRgIJT+bRLFKnoM1ldnzKoxTIn14Yxz928LQRYYgIN0=
+golang.org/x/telemetry v0.0.0-20250710130107-8d8967aff50b/go.mod h1:4ZwOYna0/zsOKwuR5X/m0QFOJpSZvAxFfkQT+Erd9D4=
+golang.org/x/telemetry v0.0.0-20250807160809-1a19826ec488/go.mod h1:fGb/2+tgXXjhjHsTNdVEEMZNWA0quBnfrO+AfoDSAKw=
+golang.org/x/telemetry v0.0.0-20250908211612-aef8a434d053/go.mod h1:+nZKN+XVh4LCiA9DV3ywrzN4gumyCnKjau3NGb9SGoE=
+golang.org/x/telemetry v0.0.0-20251008203120-078029d740a8/go.mod h1:Pi4ztBfryZoJEkyFTI5/Ocsu2jXyDr6iSdgJiYE/uwE=
+golang.org/x/telemetry v0.0.0-20251111182119-bc8e575c7b54/go.mod h1:hKdjCMrbv9skySur+Nek8Hd0uJ0GuxJIoIX2payrIdQ=
+golang.org/x/telemetry v0.0.0-20251203150158-8fff8a5912fc/go.mod h1:hKdjCMrbv9skySur+Nek8Hd0uJ0GuxJIoIX2payrIdQ=
+golang.org/x/telemetry v0.0.0-20260109210033-bd525da824e2/go.mod h1:b7fPSJ0pKZ3ccUh8gnTONJxhn3c/PS6tyzQvyqw4iA8=
+golang.org/x/telemetry v0.0.0-20260209163413-e7419c687ee4/go.mod h1:g5NllXBEermZrmR51cJDQxmJUHUOfRAaNyWBM+R+548=
+golang.org/x/telemetry v0.0.0-20260311193753-579e4da9a98c/go.mod h1:TpUTTEp9frx7rTdLpC9gFG9kdI7zVLFTFFlqaH2Cncw=
+golang.org/x/telemetry v0.0.0-20260409153401-be6f6cb8b1fa/go.mod h1:kHjTxDEnAu6/Nl9lDkzjWpR+bmKfxeiRuSDlsMb70gE=
+golang.org/x/telemetry v0.0.0-20260508192327-42602be52be6/go.mod h1:Eqhaxk/wZsWEH8CRxLwj6xzEJbz7k1EFGqx7nyCoabE=
+golang.org/x/telemetry v0.0.0-20260625142307-59b4966ccb57/go.mod h1:3AWMyWHS+caVoiEXpiq6+tzKA40J4vQT3MYr80ZtQpc=
+golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus=
+golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
+golang.org/x/tools v0.34.0/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg=
+golang.org/x/tools v0.35.0/go.mod h1:NKdj5HkL/73byiZSJjqJgKn3ep7KjFkBOkR/Hps3VPw=
+golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
+golang.org/x/tools v0.37.0/go.mod h1:MBN5QPQtLMHVdvsbtarmTNukZDdgwdwlO5qGacAzF0w=
+golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
+golang.org/x/tools v0.39.0/go.mod h1:JnefbkDPyD8UU2kI5fuf8ZX4/yUeh9W877ZeBONxUqQ=
+golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc=
+golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
+golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
+golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
+golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
 golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -334,8 +387,8 @@
 google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:q4lMZS6kskjT5HvCPrnnypcDPVJqT/f4nfxmkE7gryY=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
-google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
+google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y=
+google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ=
 google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=
 google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/cel/BUILD.bazel /work/src/external-provisioner/vendor/github.com/google/cel-go/cel/BUILD.bazel
--- a/vendor/github.com/google/cel-go/cel/BUILD.bazel	2026-09-05 00:02:32.066804322 +0000
+++ b/vendor/github.com/google/cel-go/cel/BUILD.bazel	2026-09-05 00:03:03.426974558 +0000
@@ -10,6 +10,7 @@
         "cel.go",
         "decls.go",
         "env.go",
+        "fieldpaths.go",
         "folding.go",
         "inlining.go",
         "io.go",
@@ -43,6 +44,7 @@
         "//interpreter:go_default_library",
         "//parser:go_default_library",
         "@dev_cel_expr//:expr",
+        "@dev_cel_expr//conformance/proto3:go_default_library",
         "@org_golang_google_genproto_googleapis_api//expr/v1alpha1:go_default_library",
         "@org_golang_google_protobuf//proto:go_default_library",
         "@org_golang_google_protobuf//reflect/protodesc:go_default_library",
@@ -63,6 +65,7 @@
         "cel_test.go",
         "decls_test.go",
         "env_test.go",
+        "fieldpaths_test.go",
         "folding_test.go",
         "inlining_test.go",
         "io_test.go",
@@ -78,6 +81,7 @@
     ],
     embedsrcs = [
         "//cel/testdata:prompts",
+        "//cel/testdata:test_fds_with_source_info",
     ],
     deps = [
         "//common/operators:go_default_library",
@@ -89,6 +93,7 @@
         "//test:go_default_library",
         "//test/proto2pb:go_default_library",
         "//test/proto3pb:go_default_library",
+        "@com_github_google_go_cmp//cmp:go_default_library",
         "@org_golang_google_genproto_googleapis_api//expr/v1alpha1:go_default_library",
         "@org_golang_google_protobuf//encoding/prototext:go_default_library",
         "@org_golang_google_protobuf//proto:go_default_library",
@@ -100,4 +105,4 @@
 exports_files(
     ["templates/authoring.tmpl"],
     visibility = ["//visibility:public"],
-)
\ No newline at end of file
+)
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/cel/env.go /work/src/external-provisioner/vendor/github.com/google/cel-go/cel/env.go
--- a/vendor/github.com/google/cel-go/cel/env.go	2026-09-05 00:02:32.066804322 +0000
+++ b/vendor/github.com/google/cel-go/cel/env.go	2026-09-05 00:03:03.426974558 +0000
@@ -18,6 +18,8 @@
 	"errors"
 	"fmt"
 	"math"
+	"slices"
+	"strings"
 	"sync"
 
 	"github.com/google/cel-go/checker"
@@ -139,6 +141,7 @@
 	provider        types.Provider
 	features        map[int]bool
 	appliedFeatures map[int]bool
+	limits          map[limitID]int
 	libraries       map[string]SingletonLibrary
 	validators      []ASTValidator
 	costOptions     []checker.CostOption
@@ -181,6 +184,16 @@
 		conf.AddImports(env.NewImport(typeName))
 	}
 
+	// Serialize features
+	for featID, enabled := range e.features {
+		featName, found := featureNameByID(featID)
+		if !found {
+			// If the feature isn't named, it isn't intended to be publicly exposed
+			continue
+		}
+		conf.AddFeatures(env.NewFeature(featName, enabled))
+	}
+
 	libOverloads := map[string][]string{}
 	for libName, lib := range e.libraries {
 		// Track the options which have been configured by a library and
@@ -241,7 +254,7 @@
 		fields := e.contextProto.Fields()
 		for i := 0; i < fields.Len(); i++ {
 			field := fields.Get(i)
-			variable, err := fieldToVariable(field)
+			variable, err := fieldToVariable(field, e.HasFeature(featureJSONFieldNames))
 			if err != nil {
 				return nil, fmt.Errorf("could not serialize context field variable %q, reason: %w", field.FullName(), err)
 			}
@@ -276,16 +289,45 @@
 		}
 	}
 
-	// Serialize features
-	for featID, enabled := range e.features {
-		featName, found := featureNameByID(featID)
-		if !found {
-			// If the feature isn't named, it isn't intended to be publicly exposed
+	for id, val := range e.limits {
+		limitName, found := limitNameByID(id)
+		if !found || val == 0 {
+			// skip if explicitly defaulted or not supported in config
 			continue
 		}
-		conf.AddFeatures(env.NewFeature(featName, enabled))
+		conf.AddLimits(env.NewLimit(limitName, val))
 	}
 
+	// Sort repeated fields in config where reasonable to make the export
+	// stable.
+	slices.SortFunc(conf.Imports, func(a *env.Import, b *env.Import) int {
+		return strings.Compare(a.Name, b.Name)
+	})
+
+	slices.SortFunc(conf.Extensions, func(a *env.Extension, b *env.Extension) int {
+		return strings.Compare(a.Name, b.Name)
+	})
+
+	slices.SortFunc(conf.Variables, func(a *env.Variable, b *env.Variable) int {
+		return strings.Compare(a.Name, b.Name)
+	})
+
+	slices.SortFunc(conf.Functions, func(a *env.Function, b *env.Function) int {
+		return strings.Compare(a.Name, b.Name)
+	})
+
+	slices.SortFunc(conf.Validators, func(a *env.Validator, b *env.Validator) int {
+		return strings.Compare(a.Name, b.Name)
+	})
+
+	slices.SortFunc(conf.Features, func(a *env.Feature, b *env.Feature) int {
+		return strings.Compare(a.Name, b.Name)
+	})
+
+	slices.SortFunc(conf.Limits, func(a *env.Limit, b *env.Limit) int {
+		return strings.Compare(a.Name, b.Name)
+	})
+
 	return conf, nil
 }
 
@@ -319,7 +361,7 @@
 // See the EnvOption helper functions for the options that can be used to configure the
 // environment.
 func NewCustomEnv(opts ...EnvOption) (*Env, error) {
-	registry, err := types.NewRegistry()
+	registry, err := types.NewProtoRegistry()
 	if err != nil {
 		return nil, err
 	}
@@ -333,6 +375,7 @@
 		provider:         registry,
 		features:         map[int]bool{},
 		appliedFeatures:  map[int]bool{},
+		limits:           map[limitID]int{},
 		libraries:        map[string]SingletonLibrary{},
 		validators:       []ASTValidator{},
 		progOpts:         []ProgramOption{},
@@ -393,6 +436,15 @@
 	return ast, nil
 }
 
+// configuredExpressionSizeLimit returns the effective expression size code point limit.
+// A zero value means "use the parser default".
+func (e *Env) configuredExpressionSizeLimit() int {
+	if l := e.limits[limitCodePointSize]; l != 0 {
+		return l
+	}
+	return 100_000
+}
+
 // Compile combines the Parse and Check phases CEL program compilation to produce an Ast and
 // associated issues.
 //
@@ -402,7 +454,11 @@
 //
 // Note, for parse-only uses of CEL use Parse.
 func (e *Env) Compile(txt string) (*Ast, *Issues) {
-	return e.CompileSource(common.NewTextSource(txt))
+	src, err := common.NewTextSourceWithLimit(txt, e.configuredExpressionSizeLimit())
+	if err != nil {
+		return nil, ErrorAsIssues(err)
+	}
+	return e.CompileSource(src)
 }
 
 // CompileSource combines the Parse and Check phases CEL program compilation to produce an Ast and
@@ -497,6 +553,10 @@
 	for k, v := range e.appliedFeatures {
 		appliedFeaturesCopy[k] = v
 	}
+	limitsCopy := make(map[limitID]int, len(e.limits))
+	for k, v := range e.limits {
+		limitsCopy[k] = v
+	}
 	funcsCopy := make(map[string]*decls.FunctionDecl, len(e.functions))
 	for k, v := range e.functions {
 		funcsCopy[k] = v
@@ -507,6 +567,7 @@
 	}
 	validatorsCopy := make([]ASTValidator, len(e.validators))
 	copy(validatorsCopy, e.validators)
+
 	costOptsCopy := make([]checker.CostOption, len(e.costOptions))
 	copy(costOptsCopy, e.costOptions)
 
@@ -519,6 +580,7 @@
 		progOpts:        progOptsCopy,
 		adapter:         adapter,
 		features:        featuresCopy,
+		limits:          limitsCopy,
 		appliedFeatures: appliedFeaturesCopy,
 		libraries:       libsCopy,
 		validators:      validatorsCopy,
@@ -601,7 +663,10 @@
 // This form of Parse creates a Source value for the input `txt` and forwards to the
 // ParseSource method.
 func (e *Env) Parse(txt string) (*Ast, *Issues) {
-	src := common.NewTextSource(txt)
+	src, err := common.NewTextSourceWithLimit(txt, e.configuredExpressionSizeLimit())
+	if err != nil {
+		return nil, ErrorAsIssues(err)
+	}
 	return e.ParseSource(src)
 }
 
@@ -785,11 +850,32 @@
 	if e.HasFeature(featureIdentEscapeSyntax) {
 		prsrOpts = append(prsrOpts, parser.EnableIdentEscapeSyntax(true))
 	}
+	if l := e.limits[limitParseErrorRecovery]; l != 0 {
+		prsrOpts = append(prsrOpts, parser.ErrorRecoveryLimit(l))
+	}
+	if l := e.limits[limitCodePointSize]; l != 0 {
+		prsrOpts = append(prsrOpts, parser.ExpressionSizeCodePointLimit(l))
+	}
+	if l := e.limits[limitParseRecursionDepth]; l != 0 {
+		prsrOpts = append(prsrOpts, parser.MaxRecursionDepth(l))
+	}
 	e.prsr, err = parser.NewParser(prsrOpts...)
 	if err != nil {
 		return nil, err
 	}
 
+	// Enable JSON field names is using a proto-based *types.Registry
+	if e.HasFeature(featureJSONFieldNames) {
+		reg, isReg := e.provider.(*types.Registry)
+		if !isReg {
+			return nil, fmt.Errorf("JSONFieldNames() option is only compatible with *types.Registry providers")
+		}
+		err := reg.WithJSONFieldNames(true)
+		if err != nil {
+			return nil, err
+		}
+	}
+
 	// Ensure that the checker init happens eagerly rather than lazily.
 	if e.HasFeature(featureEagerlyValidateDeclarations) {
 		_, err := e.initChecker()
@@ -808,6 +894,8 @@
 		chkOpts = append(chkOpts,
 			checker.CrossTypeNumericComparisons(
 				e.HasFeature(featureCrossTypeNumericComparisons)))
+		chkOpts = append(chkOpts,
+			checker.JSONFieldNames(e.HasFeature(featureJSONFieldNames)))
 
 		ce, err := checker.NewEnv(e.Container, e.provider, chkOpts...)
 		if err != nil {
@@ -877,6 +965,16 @@
 	info *celast.SourceInfo
 }
 
+// ErrorAsIssues wraps a Golang error into a CEL common error and issue set.
+//
+// This is a convenience method for early returning from an expression validation call path due to
+// internal state or configuration which is unrelated to the source being validated.
+func ErrorAsIssues(err error) *Issues {
+	errs := common.NewErrors(common.NewTextSource(""))
+	errs.ReportErrorString(common.NoLocation, err.Error())
+	return NewIssues(errs)
+}
+
 // NewIssues returns an Issues struct from a common.Errors object.
 func NewIssues(errs *common.Errors) *Issues {
 	return NewIssuesWithSourceInfo(errs, nil)
@@ -985,9 +1083,10 @@
 			return nil, false
 		}
 		return &types.FieldType{
-			Type:    t,
-			IsSet:   ft.IsSet,
-			GetFrom: ft.GetFrom,
+			Type:        t,
+			IsSet:       ft.IsSet,
+			GetFrom:     ft.GetFrom,
+			IsJSONField: ft.IsJSONField,
 		}, true
 	}
 	return nil, false
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/cel/fieldpaths.go /work/src/external-provisioner/vendor/github.com/google/cel-go/cel/fieldpaths.go
--- a/vendor/github.com/google/cel-go/cel/fieldpaths.go	1970-01-01 00:00:00.000000000 +0000
+++ b/vendor/github.com/google/cel-go/cel/fieldpaths.go	2026-09-05 00:03:03.426974558 +0000
@@ -0,0 +1,163 @@
+package cel
+
+import (
+	"slices"
+	"strings"
+
+	"github.com/google/cel-go/common"
+	"github.com/google/cel-go/common/types"
+)
+
+// fieldPath represents a selection path to a field from a variable in a CEL environment.
+type fieldPath struct {
+	celType *Type
+	// path represents the selection path to the field.
+	path        string
+	description string
+	isLeaf      bool
+}
+
+// Documentation implements the Documentor interface.
+func (f *fieldPath) Documentation() *common.Doc {
+	return common.NewFieldDoc(f.path, f.celType.String(), f.description)
+}
+
+type documentationProvider interface {
+	// FindStructFieldDescription returns documentation for a field if available.
+	// Returns false if the field could not be found.
+	FindStructFieldDescription(typeName, fieldName string) (string, bool)
+}
+
+type backtrack struct {
+	// provider used to resolve types.
+	provider types.Provider
+	// paths of fields that have been visited along the path.
+	path []string
+	// types of fields that have been visited along the path. used to avoid cycles.
+	types []*Type
+}
+
+func (b *backtrack) push(pathStep string, celType *Type) {
+	b.path = append(b.path, pathStep)
+	b.types = append(b.types, celType)
+}
+
+func (b *backtrack) pop() {
+	b.path = b.path[:len(b.path)-1]
+	b.types = b.types[:len(b.types)-1]
+}
+
+func formatPath(path []string) string {
+	var buffer strings.Builder
+	for i, p := range path {
+		if i == 0 {
+			buffer.WriteString(p)
+			continue
+		}
+		if strings.HasPrefix(p, "[") {
+			buffer.WriteString(p)
+			continue
+		}
+		buffer.WriteString(".")
+		buffer.WriteString(p)
+	}
+	return buffer.String()
+}
+
+func (b *backtrack) expandFieldPaths(celType *Type, paths []*fieldPath) []*fieldPath {
+	if slices.ContainsFunc(b.types[:len(b.types)-1], func(t *Type) bool { return t.String() == celType.String() }) {
+		// Cycle detected, so stop expanding.
+		paths[len(paths)-1].isLeaf = false
+		return paths
+	}
+	switch celType.Kind() {
+	case types.StructKind:
+		fields, ok := b.provider.FindStructFieldNames(celType.String())
+		if !ok {
+			// Caller added this type to the path, so it must be a leaf.
+			paths[len(paths)-1].isLeaf = true
+			return paths
+		}
+		for _, field := range fields {
+			fieldType, ok := b.provider.FindStructFieldType(celType.String(), field)
+			if !ok {
+				// Field not found, either hidden or an error.
+				continue
+			}
+			b.push(field, celType)
+			description := ""
+			if docProvider, ok := b.provider.(documentationProvider); ok {
+				description, _ = docProvider.FindStructFieldDescription(celType.String(), field)
+			}
+			path := &fieldPath{
+				celType:     fieldType.Type,
+				path:        formatPath(b.path),
+				description: description,
+				isLeaf:      false,
+			}
+			paths = append(paths, path)
+			paths = b.expandFieldPaths(fieldType.Type, paths)
+			b.pop()
+		}
+		return paths
+	case types.MapKind:
+		if len(celType.Parameters()) != 2 {
+			// dynamic map, so treat as a leaf.
+			paths[len(paths)-1].isLeaf = true
+			return paths
+		}
+		mapKeyType := celType.Parameters()[0]
+		mapValueType := celType.Parameters()[1]
+		// Add a placeholder for the map key kind (the zero value).
+		keyIdentifier := ""
+		switch mapKeyType.Kind() {
+		case types.StringKind:
+			keyIdentifier = "[\"\"]"
+		case types.IntKind:
+			keyIdentifier = "[0]"
+		case types.UintKind:
+			keyIdentifier = "[0u]"
+		case types.BoolKind:
+			keyIdentifier = "[false]"
+		default:
+			// Caller added this type to the path, so it must be a leaf.
+			paths[len(paths)-1].isLeaf = true
+			return paths
+		}
+		b.push(keyIdentifier, mapValueType)
+		defer b.pop()
+		return b.expandFieldPaths(mapValueType, paths)
+	case types.ListKind:
+		if len(celType.Parameters()) != 1 {
+			// dynamic list, so treat as a leaf.
+			paths[len(paths)-1].isLeaf = true
+			return paths
+		}
+		listElemType := celType.Parameters()[0]
+		b.push("[0]", listElemType)
+		defer b.pop()
+		return b.expandFieldPaths(listElemType, paths)
+	default:
+		paths[len(paths)-1].isLeaf = true
+	}
+
+	return paths
+}
+
+// fieldPathsForType expands the reachable fields from the given root identifier.
+func fieldPathsForType(provider types.Provider, identifier string, celType *Type) []*fieldPath {
+	b := &backtrack{
+		provider: provider,
+		path:     []string{identifier},
+		types:    []*Type{celType},
+	}
+	paths := []*fieldPath{
+		{
+			celType: celType,
+			path:    identifier,
+			isLeaf:  false,
+		},
+	}
+
+	return b.expandFieldPaths(celType, paths)
+}
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/cel/folding.go /work/src/external-provisioner/vendor/github.com/google/cel-go/cel/folding.go
--- a/vendor/github.com/google/cel-go/cel/folding.go	2026-09-05 00:02:32.066804322 +0000
+++ b/vendor/github.com/google/cel-go/cel/folding.go	2026-09-05 00:03:03.426974558 +0000
@@ -97,7 +97,7 @@
 				continue
 			}
 			// Late-bound function calls cannot be folded.
-			if fold.Kind() == ast.CallKind && isLateBoundFunctionCall(ctx, a, fold) {
+			if fold.Kind() == ast.CallKind && isLateBoundFunctionCall(ctx, fold) {
 				continue
 			}
 			// Otherwise, assume all context is needed to evaluate the expression.
@@ -168,7 +168,7 @@
 	return nil
 }
 
-func isLateBoundFunctionCall(ctx *OptimizerContext, a *ast.AST, expr ast.Expr) bool {
+func isLateBoundFunctionCall(ctx *OptimizerContext, expr ast.Expr) bool {
 	call := expr.AsCall()
 	function := ctx.Functions()[call.FunctionName()]
 	if function == nil {
@@ -518,7 +518,7 @@
 				constantExprs = false
 			}
 			// Late-bound function calls cannot be folded.
-			if e.Kind() == ast.CallKind && isLateBoundFunctionCall(ctx, a, e) {
+			if e.Kind() == ast.CallKind && isLateBoundFunctionCall(ctx, e) {
 				constantExprs = false
 			}
 		})
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/cel/inlining.go /work/src/external-provisioner/vendor/github.com/google/cel-go/cel/inlining.go
--- a/vendor/github.com/google/cel-go/cel/inlining.go	2026-09-05 00:02:32.066804322 +0000
+++ b/vendor/github.com/google/cel-go/cel/inlining.go	2026-09-05 00:03:03.426974558 +0000
@@ -178,9 +178,38 @@
 			))
 		return
 	}
+	if zeroValExpr, ok := zeroValueExpr(ctx, inlinedType); ok {
+		ctx.UpdateExpr(prev,
+			ctx.NewCall(operators.NotEquals,
+				inlined, zeroValExpr))
+		return
+	}
 	ctx.ReportErrorAtID(prev.ID(), "unable to inline expression type %v into presence test", inlinedType)
 }
 
+// zeroValueExpr creates an expression representing the empty or zero value for the given type
+// Note: bytes, lists, maps, and strings are supported via the `SizerType` trait.
+func zeroValueExpr(ctx *OptimizerContext, t *Type) (ast.Expr, bool) {
+	// Note: bytes, strings, lists, and maps are covered by the "sizer-type" check
+	switch t.Kind() {
+	case types.BoolKind:
+		return ctx.NewLiteral(types.False), true
+	case types.DoubleKind:
+		return ctx.NewLiteral(types.Double(0)), true
+	case types.DurationKind:
+		return ctx.NewCall(overloads.TypeConvertDuration, ctx.NewLiteral(types.String("0s"))), true
+	case types.IntKind:
+		return ctx.NewLiteral(types.IntZero), true
+	case types.TimestampKind:
+		return ctx.NewCall(overloads.TypeConvertTimestamp, ctx.NewLiteral(types.Int(0))), true
+	case types.StructKind:
+		return ctx.NewStruct(t.TypeName(), []ast.EntryExpr{}), true
+	case types.UintKind:
+		return ctx.NewLiteral(types.Uint(0)), true
+	}
+	return nil, false
+}
+
 // isBindable indicates whether the inlined type can be used within a cel.bind() if the expression
 // being replaced occurs within a presence test. Value types with a size() method or field selection
 // support can be bound.
@@ -212,17 +241,43 @@
 // field selection. This may be a future refinement.
 func (opt *inliningOptimizer) matchVariable(varName string) ast.ExprMatcher {
 	return func(e ast.NavigableExpr) bool {
-		if e.Kind() == ast.IdentKind && e.AsIdent() == varName {
-			return true
+		name, found := maybeAsVariableName(e)
+		if !found || name != varName {
+			return false
+		}
+
+		// Determine whether the variable being referenced has been shadowed by a comprehension
+		p, hasParent := e.Parent()
+		for hasParent {
+			if p.Kind() != ast.ComprehensionKind {
+				p, hasParent = p.Parent()
+				continue
+			}
+			// If the inline variable name matches any of the comprehension variables at any scope,
+			// return false as the variable has been shadowed.
+			compre := p.AsComprehension()
+			if varName == compre.AccuVar() || varName == compre.IterVar() || varName == compre.IterVar2() {
+				return false
+			}
+			p, hasParent = p.Parent()
 		}
-		if e.Kind() == ast.SelectKind {
-			sel := e.AsSelect()
-			// While the `ToQualifiedName` call could take the select directly, this
-			// would skip presence tests from possible matches, which we would like
-			// to include.
-			qualName, found := containers.ToQualifiedName(sel.Operand())
-			return found && qualName+"."+sel.FieldName() == varName
+
+		return true
+	}
+}
+
+func maybeAsVariableName(e ast.NavigableExpr) (string, bool) {
+	if e.Kind() == ast.IdentKind {
+		return e.AsIdent(), true
+	}
+	if e.Kind() == ast.SelectKind {
+		sel := e.AsSelect()
+		// While the `ToQualifiedName` call could take the select directly, this
+		// would skip presence tests from possible matches, which we would like
+		// to include.
+		if qualName, found := containers.ToQualifiedName(sel.Operand()); found {
+			return qualName + "." + sel.FieldName(), true
 		}
-		return false
 	}
+	return "", false
 }
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/cel/library.go /work/src/external-provisioner/vendor/github.com/google/cel-go/cel/library.go
--- a/vendor/github.com/google/cel-go/cel/library.go	2026-09-05 00:02:32.066804322 +0000
+++ b/vendor/github.com/google/cel-go/cel/library.go	2026-09-05 00:03:03.426974558 +0000
@@ -590,7 +590,7 @@
 // ProgramOptions implements the Library interface method.
 func (lib *optionalLib) ProgramOptions() []ProgramOption {
 	return []ProgramOption{
-		CustomDecorator(decorateOptionalOr),
+		CustomDecoratorV2(decorateOptionalOr),
 	}
 }
 
@@ -683,7 +683,7 @@
 	return features(featureEnableErrorOnBadPresenceTest, value)
 }
 
-func decorateOptionalOr(i interpreter.Interpretable) (interpreter.Interpretable, error) {
+func decorateOptionalOr(i interpreter.InterpretableV2) (interpreter.InterpretableV2, error) {
 	call, ok := i.(interpreter.InterpretableCall)
 	if !ok {
 		return i, nil
@@ -720,8 +720,8 @@
 // the second optional expression is evaluated and returned.
 type evalOptionalOr struct {
 	id  int64
-	lhs interpreter.Interpretable
-	rhs interpreter.Interpretable
+	lhs interpreter.InterpretableV2
+	rhs interpreter.InterpretableV2
 }
 
 // ID implements the Interpretable interface method.
@@ -729,27 +729,34 @@
 	return opt.id
 }
 
-// Eval evaluates the left-hand side optional to determine whether it contains a value, else
-// proceeds with the right-hand side evaluation.
-func (opt *evalOptionalOr) Eval(ctx interpreter.Activation) ref.Val {
+func (opt *evalOptionalOr) Exec(frame *interpreter.ExecutionFrame) ref.Val {
 	// short-circuit lhs.
-	optLHS := opt.lhs.Eval(ctx)
-	optVal, ok := optLHS.(*types.Optional)
-	if !ok {
+	optLHS := opt.lhs.Exec(frame)
+	switch val := optLHS.(type) {
+	case *types.Err, *types.Unknown:
 		return optLHS
+	case *types.Optional:
+		if val.HasValue() {
+			return optLHS
+		}
+		return opt.rhs.Exec(frame)
+	default:
+		return types.NoSuchOverloadErr()
 	}
-	if optVal.HasValue() {
-		return optVal
-	}
-	return opt.rhs.Eval(ctx)
+}
+
+// Eval evaluates the left-hand side optional to determine whether it contains a value, else
+// proceeds with the right-hand side evaluation.
+func (opt *evalOptionalOr) Eval(ctx interpreter.Activation) ref.Val {
+	return opt.Exec(interpreter.AsFrame(ctx))
 }
 
 // evalOptionalOrValue selects between an optional or a concrete value. If the optional has a value,
 // its value is returned, otherwise the alternative value expression is evaluated and returned.
 type evalOptionalOrValue struct {
 	id  int64
-	lhs interpreter.Interpretable
-	rhs interpreter.Interpretable
+	lhs interpreter.InterpretableV2
+	rhs interpreter.InterpretableV2
 }
 
 // ID implements the Interpretable interface method.
@@ -757,19 +764,27 @@
 	return opt.id
 }
 
-// Eval evaluates the left-hand side optional to determine whether it contains a value, else
-// proceeds with the right-hand side evaluation.
-func (opt *evalOptionalOrValue) Eval(ctx interpreter.Activation) ref.Val {
+func (opt *evalOptionalOrValue) Exec(frame *interpreter.ExecutionFrame) ref.Val {
 	// short-circuit lhs.
-	optLHS := opt.lhs.Eval(ctx)
-	optVal, ok := optLHS.(*types.Optional)
-	if !ok {
+	optLHS := opt.lhs.Exec(frame)
+
+	switch val := optLHS.(type) {
+	case *types.Err, *types.Unknown:
 		return optLHS
+	case *types.Optional:
+		if val.HasValue() {
+			return val.GetValue()
+		}
+		return opt.rhs.Exec(frame)
+	default:
+		return types.NoSuchOverloadErr()
 	}
-	if optVal.HasValue() {
-		return optVal.GetValue()
-	}
-	return opt.rhs.Eval(ctx)
+}
+
+// Eval evaluates the left-hand side optional to determine whether it contains a value, else
+// proceeds with the right-hand side evaluation.
+func (opt *evalOptionalOrValue) Eval(ctx interpreter.Activation) ref.Val {
+	return opt.Exec(interpreter.AsFrame(ctx))
 }
 
 type timeLegacyLibrary struct{}
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/cel/options.go /work/src/external-provisioner/vendor/github.com/google/cel-go/cel/options.go
--- a/vendor/github.com/google/cel-go/cel/options.go	2026-09-05 00:02:32.066804322 +0000
+++ b/vendor/github.com/google/cel-go/cel/options.go	2026-09-05 00:03:03.426974558 +0000
@@ -71,12 +71,16 @@
 
 	// Enable escape syntax for field identifiers (`).
 	featureIdentEscapeSyntax
+
+	// Enable accessing fields by JSON names within protobuf messages
+	featureJSONFieldNames
 )
 
 var featureIDsToNames = map[int]string{
 	featureEnableMacroCallTracking:     "cel.feature.macro_call_tracking",
 	featureCrossTypeNumericComparisons: "cel.feature.cross_type_numeric_comparisons",
 	featureIdentEscapeSyntax:           "cel.feature.backtick_escape_syntax",
+	featureJSONFieldNames:              "cel.feature.json_field_names",
 }
 
 func featureNameByID(id int) (string, bool) {
@@ -93,6 +97,40 @@
 	return 0, false
 }
 
+// limitID is used as a key for configurable limits. These are options that
+// support exporting to YAML environment config.
+type limitID int
+
+const (
+	_ = limitID(iota)
+	// The number of recursive calls permitted in parsing.
+	limitParseRecursionDepth
+	// The number of code points permitted in an input expression string.
+	limitCodePointSize
+	// The number of attempts to recover from a parse error.
+	limitParseErrorRecovery
+)
+
+var limitIDsToNames = map[limitID]string{
+	limitCodePointSize:       "cel.limit.expression_code_points",
+	limitParseErrorRecovery:  "cel.limit.parse_error_recovery",
+	limitParseRecursionDepth: "cel.limit.parse_recursion_depth",
+}
+
+func limitNameByID(id limitID) (string, bool) {
+	v, ok := limitIDsToNames[id]
+	return v, ok
+}
+
+func limitIDByName(name string) (limitID, bool) {
+	for k, v := range limitIDsToNames {
+		if v == name {
+			return k, true
+		}
+	}
+	return limitID(0), false
+}
+
 // EnvOption is a functional interface for configuring the environment.
 type EnvOption func(e *Env) (*Env, error)
 
@@ -275,9 +313,9 @@
 	}
 }
 
-// customTypeRegistry is an internal-only interface containing the minimum methods required to support
+// protoTypeRegistry is an internal-only interface containing the minimum methods required to support
 // custom types. It is a subset of methods from ref.TypeRegistry.
-type customTypeRegistry interface {
+type protoTypeRegistry interface {
 	RegisterDescriptor(protoreflect.FileDescriptor) error
 	RegisterType(...ref.Type) error
 }
@@ -294,7 +332,7 @@
 // Note: This option must be specified after the CustomTypeProvider option when used together.
 func Types(addTypes ...any) EnvOption {
 	return func(e *Env) (*Env, error) {
-		reg, isReg := e.provider.(customTypeRegistry)
+		reg, isReg := e.provider.(protoTypeRegistry)
 		if !isReg {
 			return nil, fmt.Errorf("custom types not supported by provider: %T", e.provider)
 		}
@@ -331,7 +369,7 @@
 // extension or by re-using the same EnvOption with another NewEnv() call.
 func TypeDescs(descs ...any) EnvOption {
 	return func(e *Env) (*Env, error) {
-		reg, isReg := e.provider.(customTypeRegistry)
+		reg, isReg := e.provider.(protoTypeRegistry)
 		if !isReg {
 			return nil, fmt.Errorf("custom types not supported by provider: %T", e.provider)
 		}
@@ -379,7 +417,7 @@
 	}
 }
 
-func registerFileSet(reg customTypeRegistry, fileSet *descpb.FileDescriptorSet) error {
+func registerFileSet(reg protoTypeRegistry, fileSet *descpb.FileDescriptorSet) error {
 	files, err := protodesc.NewFiles(fileSet)
 	if err != nil {
 		return fmt.Errorf("protodesc.NewFiles(%v) failed: %v", fileSet, err)
@@ -387,7 +425,7 @@
 	return registerFiles(reg, files)
 }
 
-func registerFiles(reg customTypeRegistry, files *protoregistry.Files) error {
+func registerFiles(reg protoTypeRegistry, files *protoregistry.Files) error {
 	var err error
 	files.RangeFiles(func(fd protoreflect.FileDescriptor) bool {
 		err = reg.RegisterDescriptor(fd)
@@ -396,6 +434,15 @@
 	return err
 }
 
+// JSONFieldNames supports accessing protocol buffer fields by json-name.
+//
+// Enabling JSON field name support will create a copy of the types.Registry with fields indexed
+// by JSON name, and whether JSON name or Proto-style names are supported will be inferred from
+// the AST extensions metadata.
+func JSONFieldNames(enabled bool) EnvOption {
+	return features(featureJSONFieldNames, enabled)
+}
+
 // ProgramOption is a functional interface for configuring evaluation bindings and behaviors.
 type ProgramOption func(p *prog) (*prog, error)
 
@@ -409,6 +456,14 @@
 	}
 }
 
+// CustomDecoratorV2 appends an InterpreterDecoratorV2 to the program.
+func CustomDecoratorV2(dec interpreter.InterpretableDecoratorV2) ProgramOption {
+	return func(p *prog) (*prog, error) {
+		p.plannerOptions = append(p.plannerOptions, interpreter.CustomDecoratorV2(dec))
+		return p, nil
+	}
+}
+
 // Functions adds function overloads that extend or override the set of CEL built-ins.
 //
 // Deprecated: use Function() instead to declare the function, its overload signatures,
@@ -523,6 +578,17 @@
 		envOpts = append(envOpts, Abbrevs(imp.Name))
 	}
 
+	// Configure features and common limits.
+	for _, feat := range config.Features {
+		// Note, if a feature is not found, it is skipped as it is possible the feature
+		// is not intended to be supported publicly. In the future, a refinement of
+		// to this strategy to report unrecognized features and validators should probably
+		// be covered as a standard ConfigOptionFactory
+		if id, found := featureIDByName(feat.Name); found {
+			envOpts = append(envOpts, features(id, feat.Enabled))
+		}
+	}
+
 	// Configure the context variable declaration
 	if config.ContextVariable != nil {
 		typeName := config.ContextVariable.TypeName
@@ -564,14 +630,9 @@
 		envOpts = append(envOpts, FunctionDecls(funcs...))
 	}
 
-	// Configure features
-	for _, feat := range config.Features {
-		// Note, if a feature is not found, it is skipped as it is possible the feature
-		// is not intended to be supported publicly. In the future, a refinement of
-		// to this strategy to report unrecognized features and validators should probably
-		// be covered as a standard ConfigOptionFactory
-		if id, found := featureIDByName(feat.Name); found {
-			envOpts = append(envOpts, features(id, feat.Enabled))
+	for _, limit := range config.Limits {
+		if id, found := limitIDByName(limit.Name); found {
+			envOpts = append(envOpts, setLimit(id, limit.Value))
 		}
 	}
 
@@ -727,8 +788,11 @@
 	return nil, fmt.Errorf("field %s type %s not implemented", field.FullName(), field.Kind().String())
 }
 
-func fieldToVariable(field protoreflect.FieldDescriptor) (*decls.VariableDecl, error) {
+func fieldToVariable(field protoreflect.FieldDescriptor, jsonFieldNames bool) (*decls.VariableDecl, error) {
 	name := string(field.Name())
+	if jsonFieldNames {
+		name = field.JSONName()
+	}
 	if field.IsMap() {
 		mapKey := field.MapKey()
 		mapValue := field.MapValue()
@@ -759,6 +823,8 @@
 // DeclareContextProto returns an option to extend CEL environment with declarations from the given context proto.
 // Each field of the proto defines a variable of the same name in the environment.
 // https://github.com/google/cel-spec/blob/master/doc/langdef.md#evaluation-environment
+//
+// If using JSONFieldNames(), ensure that the option is set before DeclareContextProto is provided.
 func DeclareContextProto(descriptor protoreflect.MessageDescriptor) EnvOption {
 	return func(e *Env) (*Env, error) {
 		if e.contextProto != nil {
@@ -768,9 +834,10 @@
 		e.contextProto = descriptor
 		fields := descriptor.Fields()
 		vars := make([]*decls.VariableDecl, 0, fields.Len())
+		jsonFieldNames := e.HasFeature(featureJSONFieldNames)
 		for i := 0; i < fields.Len(); i++ {
 			field := fields.Get(i)
-			variable, err := fieldToVariable(field)
+			variable, err := fieldToVariable(field, jsonFieldNames)
 			if err != nil {
 				return nil, err
 			}
@@ -789,11 +856,15 @@
 //
 // Consider using with `DeclareContextProto` to simplify variable type declarations and publishing when using
 // protocol buffers.
-func ContextProtoVars(ctx proto.Message) (Activation, error) {
+//
+// Use the types.JSONFieldNames(true) option to populate the context proto vars using the JSON field names.
+func ContextProtoVars(ctx proto.Message, opts ...types.RegistryOption) (Activation, error) {
 	if ctx == nil || !ctx.ProtoReflect().IsValid() {
 		return interpreter.EmptyActivation(), nil
 	}
-	reg, err := types.NewRegistry(ctx)
+	regOpts := []types.RegistryOption{types.ProtoTypeDefs(ctx)}
+	regOpts = append(regOpts, opts...)
+	reg, err := types.NewProtoRegistry(regOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -803,15 +874,19 @@
 	vars := make(map[string]any, fields.Len())
 	for i := 0; i < fields.Len(); i++ {
 		field := fields.Get(i)
-		sft, found := reg.FindStructFieldType(typeName, field.TextName())
+		fieldName := field.TextName()
+		if reg.JSONFieldNames() {
+			fieldName = field.JSONName()
+		}
+		sft, found := reg.FindStructFieldType(typeName, fieldName)
 		if !found {
-			return nil, fmt.Errorf("no such field: %s", field.TextName())
+			return nil, fmt.Errorf("no such field: %s", fieldName)
 		}
 		fieldVal, err := sft.GetFrom(ctx)
 		if err != nil {
 			return nil, err
 		}
-		vars[field.TextName()] = fieldVal
+		vars[fieldName] = fieldVal
 	}
 	return NewActivation(vars)
 }
@@ -847,22 +922,32 @@
 	}
 }
 
-// ParserRecursionLimit adjusts the AST depth the parser will tolerate.
-// Defaults defined in the parser package.
-func ParserRecursionLimit(limit int) EnvOption {
+func setLimit(id limitID, limit int) EnvOption {
+	if limit < 0 {
+		limit = -1
+	}
 	return func(e *Env) (*Env, error) {
-		e.prsrOpts = append(e.prsrOpts, parser.MaxRecursionDepth(limit))
+		e.limits[id] = limit
 		return e, nil
 	}
 }
 
-// ParserExpressionSizeLimit adjusts the number of code points the expression parser is allowed to parse.
+// ParserRecursionLimit adjusts the AST depth the parser will tolerate.
 // Defaults defined in the parser package.
+func ParserRecursionLimit(limit int) EnvOption {
+	return setLimit(limitParseRecursionDepth, limit)
+}
+
+// ParserErrorRecoveryLimit sets the number of attemtps the parser will take
+// to recover after encountering an error.
+func ParserErrorRecoveryLimit(limit int) EnvOption {
+	return setLimit(limitParseErrorRecovery, limit)
+}
+
+// ParserExpressionSizeLimit adjusts the number of code points the expression parser is allowed to parse.
+// Defaults are defined in the parser package. A negative value means unbounded.
 func ParserExpressionSizeLimit(limit int) EnvOption {
-	return func(e *Env) (*Env, error) {
-		e.prsrOpts = append(e.prsrOpts, parser.ExpressionSizeCodePointLimit(limit))
-		return e, nil
-	}
+	return setLimit(limitCodePointSize, limit)
 }
 
 // EnableHiddenAccumulatorName sets the parser to use the identifier '@result' for accumulators
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/cel/program.go /work/src/external-provisioner/vendor/github.com/google/cel-go/cel/program.go
--- a/vendor/github.com/google/cel-go/cel/program.go	2026-09-05 00:02:32.066804322 +0000
+++ b/vendor/github.com/google/cel-go/cel/program.go	2026-09-05 00:03:03.426974558 +0000
@@ -16,8 +16,8 @@
 
 import (
 	"context"
+	"errors"
 	"fmt"
-	"sync"
 
 	"github.com/google/cel-go/common/ast"
 	"github.com/google/cel-go/common/functions"
@@ -159,7 +159,7 @@
 	regexOptimizations []*interpreter.RegexOptimization
 
 	// Interpretable configured from an Ast and aggregate decorator set based on program options.
-	interpretable     interpreter.Interpretable
+	interpretable     interpreter.InterpretableV2
 	observable        *interpreter.ObservableInterpretable
 	callCostEstimator interpreter.ActualCostEstimator
 	costOptions       []interpreter.CostTrackerOption
@@ -218,6 +218,12 @@
 	attrFactorOpts := []interpreter.AttrFactoryOption{
 		interpreter.EnableErrorOnBadPresenceTest(p.HasFeature(featureEnableErrorOnBadPresenceTest)),
 	}
+	if a.SourceInfo().HasExtension("json_name", ast.NewExtensionVersion(1, 1)) {
+		if !e.HasFeature(featureJSONFieldNames) {
+			return nil, errors.New("the AST extension 'json_name' requires the option cel.JSONFieldNames(true)")
+		}
+	}
+	// Configure the type provider, considering whether the AST indicates whether it supports JSON field names
 	if p.evalOpts&OptPartialEval == OptPartialEval {
 		attrFactory = interpreter.NewPartialAttributeFactory(e.Container, e.adapter, e.provider, attrFactorOpts...)
 	} else {
@@ -255,8 +261,16 @@
 		if p.costLimit != nil {
 			costOpts = append(costOpts, interpreter.CostTrackerLimit(*p.costLimit))
 		}
+		// Creating a new cost tracker for each evaluation causes significant work that
+		// needs to be repeated for each evaluation even though the cost tracker is
+		// mostly read-only once constructed. Therefore it gets constructed
+		// once now and later a cheap clone is used for each evaluation.
+		tracker, err := interpreter.NewCostTracker(p.callCostEstimator, costOpts...)
+		if err != nil {
+			return nil, fmt.Errorf("construct cost tracker: %w", err)
+		}
 		trackerFactory := func() (*interpreter.CostTracker, error) {
-			return interpreter.NewCostTracker(p.callCostEstimator, costOpts...)
+			return tracker.Clone()
 		}
 		var observers []interpreter.PlannerOption
 		if p.evalOpts&(OptExhaustiveEval|OptTrackState) != 0 {
@@ -306,22 +320,19 @@
 		}
 	}()
 	// Build a hierarchical activation if there are default vars set.
-	var vars Activation
-	switch v := input.(type) {
-	case Activation:
-		vars = v
-	case map[string]any:
-		vars = activationPool.Setup(v)
-		defer activationPool.Put(vars)
-	default:
-		return nil, nil, fmt.Errorf("invalid input, wanted Activation or map[string]any, got: (%T)%v", input, input)
-	}
-	if p.defaultVars != nil {
-		vars = interpreter.NewHierarchicalActivation(p.defaultVars, vars)
+	var frame *interpreter.ExecutionFrame
+	if f, ok := input.(*interpreter.ExecutionFrame); ok {
+		frame = f
+	} else {
+		frame, err = p.newExecutionFrame(input)
+		if err != nil {
+			return nil, nil, err
+		}
+		defer frame.Close()
 	}
 	if p.observable != nil {
 		det = &EvalDetails{}
-		out = p.observable.ObserveEval(vars, func(observed any) {
+		out = p.observable.ObserveExec(frame, func(observed any) {
 			switch o := observed.(type) {
 			case interpreter.EvalState:
 				det.state = o
@@ -330,7 +341,7 @@
 			}
 		})
 	} else {
-		out = p.interpretable.Eval(vars)
+		out = p.interpretable.Exec(frame)
 	}
 	// The output of an internal Eval may have a value (`v`) that is a types.Err. This step
 	// translates the CEL value to a Go error response. This interface does not quite match the
@@ -346,160 +357,29 @@
 	if ctx == nil {
 		return nil, nil, fmt.Errorf("context can not be nil")
 	}
-	// Configure the input, making sure to wrap Activation inputs in the special ctxActivation which
-	// exposes the #interrupted variable and manages rate-limited checks of the ctx.Done() state.
-	var vars Activation
-	switch v := input.(type) {
-	case Activation:
-		vars = ctxActivationPool.Setup(v, ctx.Done(), p.interruptCheckFrequency)
-		defer ctxActivationPool.Put(vars)
-	case map[string]any:
-		rawVars := activationPool.Setup(v)
-		defer activationPool.Put(rawVars)
-		vars = ctxActivationPool.Setup(rawVars, ctx.Done(), p.interruptCheckFrequency)
-		defer ctxActivationPool.Put(vars)
-	default:
-		return nil, nil, fmt.Errorf("invalid input, wanted Activation or map[string]any, got: (%T)%v", input, input)
-	}
-	return p.Eval(vars)
-}
-
-type ctxEvalActivation struct {
-	parent                  Activation
-	interrupt               <-chan struct{}
-	interruptCheckCount     uint
-	interruptCheckFrequency uint
-}
-
-// ResolveName implements the Activation interface method, but adds a special #interrupted variable
-// which is capable of testing whether a 'done' signal is provided from a context.Context channel.
-func (a *ctxEvalActivation) ResolveName(name string) (any, bool) {
-	if name == "#interrupted" {
-		a.interruptCheckCount++
-		if a.interruptCheckCount%a.interruptCheckFrequency == 0 {
-			select {
-			case <-a.interrupt:
-				return true, true
-			default:
-				return nil, false
-			}
-		}
-		return nil, false
+	frame, err := p.newExecutionFrame(input)
+	if err != nil {
+		return nil, nil, err
 	}
-	return a.parent.ResolveName(name)
-}
-
-func (a *ctxEvalActivation) Parent() Activation {
-	return a.parent
-}
-
-func (a *ctxEvalActivation) AsPartialActivation() (interpreter.PartialActivation, bool) {
-	pa, ok := a.parent.(interpreter.PartialActivation)
-	return pa, ok
-}
-
-func newCtxEvalActivationPool() *ctxEvalActivationPool {
-	return &ctxEvalActivationPool{
-		Pool: sync.Pool{
-			New: func() any {
-				return &ctxEvalActivation{}
-			},
-		},
+	defer frame.Close()
+	frame.SetContext(ctx, p.interruptCheckFrequency)
+	out, det, errEval := p.Eval(frame)
+	if errEval != nil && errors.Is(errEval, interpreter.InterruptError{}) {
+		return out, det, fmt.Errorf("%w: %w", errEval, context.Cause(ctx))
 	}
+	return out, det, errEval
 }
 
-type ctxEvalActivationPool struct {
-	sync.Pool
-}
-
-// Setup initializes a pooled Activation with the ability check for context.Context cancellation
-func (p *ctxEvalActivationPool) Setup(vars Activation, done <-chan struct{}, interruptCheckRate uint) *ctxEvalActivation {
-	a := p.Pool.Get().(*ctxEvalActivation)
-	a.parent = vars
-	a.interrupt = done
-	a.interruptCheckCount = 0
-	a.interruptCheckFrequency = interruptCheckRate
-	return a
-}
-
-type evalActivation struct {
-	vars     map[string]any
-	lazyVars map[string]any
-}
-
-// ResolveName looks up the value of the input variable name, if found.
-//
-// Lazy bindings may be supplied within the map-based input in either of the following forms:
-// - func() any
-// - func() ref.Val
-//
-// The lazy binding will only be invoked once per evaluation.
-//
-// Values which are not represented as ref.Val types on input may be adapted to a ref.Val using
-// the types.Adapter configured in the environment.
-func (a *evalActivation) ResolveName(name string) (any, bool) {
-	v, found := a.vars[name]
-	if !found {
-		return nil, false
-	}
-	switch obj := v.(type) {
-	case func() ref.Val:
-		if resolved, found := a.lazyVars[name]; found {
-			return resolved, true
-		}
-		lazy := obj()
-		a.lazyVars[name] = lazy
-		return lazy, true
-	case func() any:
-		if resolved, found := a.lazyVars[name]; found {
-			return resolved, true
-		}
-		lazy := obj()
-		a.lazyVars[name] = lazy
-		return lazy, true
-	default:
-		return obj, true
+// newExecutionFrame creates an ExecutionFrame for the given input without a timeout context.
+func (p *prog) newExecutionFrame(input any) (*interpreter.ExecutionFrame, error) {
+	frame, err := interpreter.NewExecutionFrame(input)
+	if err != nil {
+		return nil, err
 	}
-}
-
-// Parent implements the Activation interface
-func (a *evalActivation) Parent() Activation {
-	return nil
-}
-
-func newEvalActivationPool() *evalActivationPool {
-	return &evalActivationPool{
-		Pool: sync.Pool{
-			New: func() any {
-				return &evalActivation{lazyVars: make(map[string]any)}
-			},
-		},
+	if p.defaultVars != nil {
+		// Update the frame's activation in place.
+		frame.Activation = interpreter.NewHierarchicalActivation(p.defaultVars, frame.Activation)
 	}
-}
-
-type evalActivationPool struct {
-	sync.Pool
-}
 
-// Setup initializes a pooled Activation object with the map input.
-func (p *evalActivationPool) Setup(vars map[string]any) *evalActivation {
-	a := p.Pool.Get().(*evalActivation)
-	a.vars = vars
-	return a
+	return frame, nil
 }
-
-func (p *evalActivationPool) Put(value any) {
-	a := value.(*evalActivation)
-	for k := range a.lazyVars {
-		delete(a.lazyVars, k)
-	}
-	p.Pool.Put(a)
-}
-
-var (
-	// activationPool is an internally managed pool of Activation values that wrap map[string]any inputs
-	activationPool = newEvalActivationPool()
-
-	// ctxActivationPool is an internally managed pool of Activation values that expose a special #interrupted variable
-	ctxActivationPool = newCtxEvalActivationPool()
-)
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/cel/prompt.go /work/src/external-provisioner/vendor/github.com/google/cel-go/cel/prompt.go
--- a/vendor/github.com/google/cel-go/cel/prompt.go	2026-09-05 00:02:32.066804322 +0000
+++ b/vendor/github.com/google/cel-go/cel/prompt.go	2026-09-05 00:03:03.426974558 +0000
@@ -1,155 +1,233 @@
-// Copyright 2025 Google LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//    https://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package cel
-
-import (
-	_ "embed"
-	"sort"
-	"strings"
-	"text/template"
-
-	"github.com/google/cel-go/common"
-	"github.com/google/cel-go/common/operators"
-	"github.com/google/cel-go/common/overloads"
-)
-
-//go:embed templates/authoring.tmpl
-var authoringPrompt string
-
-// AuthoringPrompt creates a prompt template from a CEL environment for the purpose of AI-assisted authoring.
-func AuthoringPrompt(env *Env) (*Prompt, error) {
-	funcMap := template.FuncMap{
-		"split": func(str string) []string { return strings.Split(str, "\n") },
-	}
-	tmpl := template.New("cel").Funcs(funcMap)
-	tmpl, err := tmpl.Parse(authoringPrompt)
-	if err != nil {
-		return nil, err
-	}
-	return &Prompt{
-		Persona:      defaultPersona,
-		FormatRules:  defaultFormatRules,
-		GeneralUsage: defaultGeneralUsage,
-		tmpl:         tmpl,
-		env:          env,
-	}, nil
-}
-
-// Prompt represents the core components of an LLM prompt based on a CEL environment.
-//
-// All fields of the prompt may be overwritten / modified with support for rendering the
-// prompt to a human-readable string.
-type Prompt struct {
-	// Persona indicates something about the kind of user making the request
-	Persona string
-
-	// FormatRules indicate how the LLM should generate its output
-	FormatRules string
-
-	// GeneralUsage specifies additional context on how CEL should be used.
-	GeneralUsage string
-
-	// tmpl is the text template base-configuration for rendering text.
-	tmpl *template.Template
-
-	// env reference used to collect variables, functions, and macros available to the prompt.
-	env *Env
-}
-
-type promptInst struct {
-	*Prompt
-
-	Variables  []*common.Doc
-	Macros     []*common.Doc
-	Functions  []*common.Doc
-	UserPrompt string
-}
-
-// Render renders the user prompt with the associated context from the prompt template
-// for use with LLM generators.
-func (p *Prompt) Render(userPrompt string) string {
-	var buffer strings.Builder
-	vars := make([]*common.Doc, len(p.env.Variables()))
-	for i, v := range p.env.Variables() {
-		vars[i] = v.Documentation()
-	}
-	sort.SliceStable(vars, func(i, j int) bool {
-		return vars[i].Name < vars[j].Name
-	})
-	macs := make([]*common.Doc, len(p.env.Macros()))
-	for i, m := range p.env.Macros() {
-		macs[i] = m.(common.Documentor).Documentation()
-	}
-	funcs := make([]*common.Doc, 0, len(p.env.Functions()))
-	for _, f := range p.env.Functions() {
-		if _, hidden := hiddenFunctions[f.Name()]; hidden {
-			continue
-		}
-		funcs = append(funcs, f.Documentation())
-	}
-	sort.SliceStable(funcs, func(i, j int) bool {
-		return funcs[i].Name < funcs[j].Name
-	})
-	inst := &promptInst{
-		Prompt:     p,
-		Variables:  vars,
-		Macros:     macs,
-		Functions:  funcs,
-		UserPrompt: userPrompt}
-	p.tmpl.Execute(&buffer, inst)
-	return buffer.String()
-}
-
-const (
-	defaultPersona = `You are a software engineer with expertise in networking and application security
-authoring boolean Common Expression Language (CEL) expressions to ensure firewall,
-networking, authentication, and data access is only permitted when all conditions
-are satisfied.`
-
-	defaultFormatRules = `Output your response as a CEL expression.
-
-Write the expression with the comment on the first line and the expression on the
-subsequent lines. Format the expression using 80-character line limits commonly
-found in C++ or Java code.`
-
-	defaultGeneralUsage = `CEL supports Protocol Buffer and JSON types, as well as simple types and aggregate types.
-
-Simple types include bool, bytes, double, int, string, and uint:
-
-* double literals must always include a decimal point: 1.0, 3.5, -2.2
-* uint literals must be positive values suffixed with a 'u': 42u
-* byte literals are strings prefixed with a 'b': b'1235'
-* string literals can use either single quotes or double quotes: 'hello', "world"
-* string literals can also be treated as raw strings that do not require any
-  escaping within the string by using the 'R' prefix: R"""quote: "hi" """
-
-Aggregate types include list and map:
-
-* list literals consist of zero or more values between brackets: "['a', 'b', 'c']"
-* map literal consist of colon-separated key-value pairs within braces: "{'key1': 1, 'key2': 2}"
-* Only int, uint, string, and bool types are valid map keys.
-* Maps containing HTTP headers must always use lower-cased string keys.
-
-Comments start with two-forward slashes followed by text and a newline.`
-)
-
-var (
-	hiddenFunctions = map[string]bool{
-		overloads.DeprecatedIn:        true,
-		operators.OldIn:               true,
-		operators.OldNotStrictlyFalse: true,
-		operators.NotStrictlyFalse:    true,
-	}
-)
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cel
+
+import (
+	_ "embed"
+	"sort"
+	"strings"
+	"text/template"
+
+	"github.com/google/cel-go/common"
+	"github.com/google/cel-go/common/operators"
+	"github.com/google/cel-go/common/overloads"
+	"github.com/google/cel-go/common/types"
+)
+
+//go:embed templates/authoring.tmpl
+var authoringPrompt string
+
+// splitImpl splits a string into a list of strings.
+//
+// Normalizes extracted comments (trim common prefix whitespace and extra trailing newlines).
+func splitImpl(str string) []string {
+	str = strings.TrimRight(str, " \n\t\r")
+	out := strings.Split(str, "\n")
+	if len(out) == 0 {
+		return nil
+	}
+	negative := strings.TrimLeft(out[0], " \t")
+	lenNegative := len(negative)
+	lenOut := len(out[0])
+	if lenNegative == lenOut {
+		return out
+	}
+	prefix := out[0][:lenOut-lenNegative]
+	trimmed := make([]string, len(out))
+	for i, line := range out {
+		if line == "" {
+			trimmed[i] = ""
+			continue
+		}
+		if !strings.HasPrefix(line, prefix) {
+			return out
+		}
+		trimmed[i] = strings.TrimPrefix(line, prefix)
+	}
+
+	return trimmed
+}
+
+// AuthoringPrompt creates a prompt template from a CEL environment for the purpose of AI-assisted authoring.
+func AuthoringPrompt(env *Env) (*Prompt, error) {
+	funcMap := template.FuncMap{
+		"split":          splitImpl,
+		"newlineToSpace": func(str string) string { return strings.ReplaceAll(str, "\n", " ") },
+	}
+	tmpl := template.New("cel").Funcs(funcMap)
+	tmpl, err := tmpl.Parse(authoringPrompt)
+	if err != nil {
+		return nil, err
+	}
+	return &Prompt{
+		Persona:      defaultPersona,
+		FormatRules:  defaultFormatRules,
+		GeneralUsage: defaultGeneralUsage,
+		tmpl:         tmpl,
+		env:          env,
+	}, nil
+}
+
+// AuthoringPromptWithFieldPaths creates a prompt template from a CEL environment for the purpose of AI-assisted authoring.
+// Includes documentation for all of the reachable field paths in the environment.
+func AuthoringPromptWithFieldPaths(env *Env) (*Prompt, error) {
+	p, err := AuthoringPrompt(env)
+	if err != nil {
+		return nil, err
+	}
+	p.fieldPaths = true
+	return p, nil
+}
+
+// Prompt represents the core components of an LLM prompt based on a CEL environment.
+//
+// All fields of the prompt may be overwritten / modified with support for rendering the
+// prompt to a human-readable string.
+type Prompt struct {
+	// Persona indicates something about the kind of user making the request
+	Persona string
+
+	// FormatRules indicate how the LLM should generate its output
+	FormatRules string
+
+	// GeneralUsage specifies additional context on how CEL should be used.
+	GeneralUsage string
+
+	// tmpl is the text template base-configuration for rendering text.
+	tmpl *template.Template
+
+	// fieldPaths is a flag to include reachable field paths in the prompt.
+	fieldPaths bool
+
+	// env reference used to collect variables, functions, and macros available to the prompt.
+	env *Env
+}
+
+type promptVariable struct {
+	*common.Doc
+	FieldPaths []*common.Doc
+}
+
+type promptInst struct {
+	*Prompt
+
+	Variables  []*promptVariable
+	Macros     []*common.Doc
+	Functions  []*common.Doc
+	UserPrompt string
+}
+
+// Render renders the user prompt with the associated context from the prompt template
+// for use with LLM generators.
+//
+// User-supplied input is passed as template data via the UserPrompt field, which
+// Go's text/template renders as a literal string value. Template action delimiters
+// such as {{.Persona}} in the user prompt are never evaluated as template directives
+// because text/template only executes directives present in the template definition
+// itself, not in data values interpolated at render time.
+func (p *Prompt) Render(userPrompt string) string {
+	var buffer strings.Builder
+	vars := make([]*promptVariable, len(p.env.Variables()))
+	for i, v := range p.env.Variables() {
+		vars[i] = &promptVariable{Doc: v.Documentation()}
+		if p.fieldPaths && v.Type().Kind() == types.StructKind {
+			var fieldPaths []*common.Doc
+
+			paths := fieldPathsForType(p.env.CELTypeProvider(), v.Name(), v.Type())
+			if len(paths) < 2 {
+				paths = nil
+			} else {
+				// First path is the variable which is already documented.
+				paths = paths[1:]
+			}
+			for _, path := range paths {
+				fieldPaths = append(fieldPaths, path.Documentation())
+			}
+
+			sort.SliceStable(fieldPaths, func(i, j int) bool {
+				return fieldPaths[i].Name < fieldPaths[j].Name
+			})
+			vars[i].FieldPaths = fieldPaths
+		}
+	}
+	sort.SliceStable(vars, func(i, j int) bool {
+		return vars[i].Name < vars[j].Name
+	})
+	macs := make([]*common.Doc, len(p.env.Macros()))
+	for i, m := range p.env.Macros() {
+		macs[i] = m.(common.Documentor).Documentation()
+	}
+	funcs := make([]*common.Doc, 0, len(p.env.Functions()))
+	for _, f := range p.env.Functions() {
+		if _, hidden := hiddenFunctions[f.Name()]; hidden {
+			continue
+		}
+		funcs = append(funcs, f.Documentation())
+	}
+	sort.SliceStable(funcs, func(i, j int) bool {
+		return funcs[i].Name < funcs[j].Name
+	})
+	inst := &promptInst{
+		Prompt:     p,
+		Variables:  vars,
+		Macros:     macs,
+		Functions:  funcs,
+		UserPrompt: userPrompt,
+	}
+	p.tmpl.Execute(&buffer, inst)
+	return buffer.String()
+}
+
+const (
+	defaultPersona = `You are a software engineer with expertise in networking and application security
+authoring boolean Common Expression Language (CEL) expressions to ensure firewall,
+networking, authentication, and data access is only permitted when all conditions
+are satisfied.`
+
+	defaultFormatRules = `Output your response as a CEL expression.
+
+Write the expression with the comment on the first line and the expression on the
+subsequent lines. Format the expression using 80-character line limits commonly
+found in C++ or Java code.`
+
+	defaultGeneralUsage = `CEL supports Protocol Buffer and JSON types, as well as simple types and aggregate types.
+
+Simple types include bool, bytes, double, int, string, and uint:
+
+* double literals must always include a decimal point: 1.0, 3.5, -2.2
+* uint literals must be positive values suffixed with a 'u': 42u
+* byte literals are strings prefixed with a 'b': b'1235'
+* string literals can use either single quotes or double quotes: 'hello', "world"
+* string literals can also be treated as raw strings that do not require any
+  escaping within the string by using the 'R' prefix: R"""quote: "hi" """
+
+Aggregate types include list and map:
+
+* list literals consist of zero or more values between brackets: "['a', 'b', 'c']"
+* map literal consist of colon-separated key-value pairs within braces: "{'key1': 1, 'key2': 2}"
+* Only int, uint, string, and bool types are valid map keys.
+* Maps containing HTTP headers must always use lower-cased string keys.
+
+Comments start with two-forward slashes followed by text and a newline.`
+)
+
+var (
+	hiddenFunctions = map[string]bool{
+		overloads.DeprecatedIn:        true,
+		operators.OldIn:               true,
+		operators.OldNotStrictlyFalse: true,
+		operators.NotStrictlyFalse:    true,
+	}
+)
\ No newline at end of file
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/cel/templates/authoring.tmpl /work/src/external-provisioner/vendor/github.com/google/cel-go/cel/templates/authoring.tmpl
--- a/vendor/github.com/google/cel-go/cel/templates/authoring.tmpl	2026-09-05 00:02:32.066804322 +0000
+++ b/vendor/github.com/google/cel-go/cel/templates/authoring.tmpl	2026-09-05 00:03:03.426974558 +0000
@@ -1,12 +1,29 @@
-{{define "variable"}}{{.Name}} is a {{.Type}}{{if .Description}}
-
-{{range split .Description}}      {{.}}
+{{define "fieldPath" }}
+    * path: `{{.Name}}`
+      type: `{{.Type}}`
+      {{- if .Description }}
+      description:
+{{range split .Description }}        {{.}}
 {{end}}
 {{- end -}}
 {{- end -}}
 
+{{define "variable" -}}
+* name: `{{.Name}}`
+  type: `{{.Type}}`
+  {{- if .Description}}
+  description:
+{{range split .Description}}    {{.}}
+{{end -}}
+{{- end -}}
+{{- if .FieldPaths }}
+  attributes:
+{{- range .FieldPaths }}{{ template "fieldPath" . }}{{end}}
+{{- end -}}
+{{- end -}}
+
 {{define "macro" -}}
-{{.Name}} macro{{if .Description}} - {{range split .Description}}{{.}} {{end}}
+{{.Name}} macro{{if .Description}} - {{newlineToSpace .Description}}
 {{end}}
 {{range .Children}}{{range split .Description}}      {{.}}
 {{end}}
@@ -22,7 +39,7 @@
 {{- end -}}
 
 {{define "function" -}}
-{{.Name}}{{if .Description}} - {{range split .Description}}{{.}} {{end}}
+{{.Name}}{{if .Description}} - {{newlineToSpace .Description}}
 {{end}}
 {{range .Children}}{{template "overload" .}}{{end}}
 {{- end -}}
@@ -36,25 +53,26 @@
 {{if .Variables}}
 Variables:
 
-{{range .Variables}}* {{template "variable" .}}
+{{range .Variables -}}
+{{template "variable" .}}
 {{end -}}
+{{- end -}}
 
-{{end -}}
 {{if .Macros}}
 Macros:
 
 {{range .Macros}}* {{template "macro" .}}
 {{end -}}
-
 {{end -}}
+
 {{if .Functions}}
 Functions:
 
 {{range .Functions}}* {{template "function" .}}
 {{end -}}
-
-{{end -}}
 {{- end -}}
+{{- end -}}
+
 {{.GeneralUsage}}
 
 {{.UserPrompt}}
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/checker/checker.go /work/src/external-provisioner/vendor/github.com/google/cel-go/checker/checker.go
--- a/vendor/github.com/google/cel-go/checker/checker.go	2026-09-05 00:02:32.066804322 +0000
+++ b/vendor/github.com/google/cel-go/checker/checker.go	2026-09-05 00:03:03.426974558 +0000
@@ -71,6 +71,11 @@
 	// check() deletes some nodes while rewriting the AST. For example the Select operand is
 	// deleted when a variable reference is replaced with a Ident expression.
 	c.AST.ClearUnusedIDs()
+	if env.jsonFieldNames {
+		c.AST.SourceInfo().AddExtension(
+			ast.NewExtension("json_name", ast.NewExtensionVersion(1, 1), ast.ComponentRuntime),
+		)
+	}
 	return c.AST, errs
 }
 
@@ -718,6 +723,9 @@
 	}
 
 	if ft, found := c.env.provider.FindStructFieldType(structType, fieldName); found {
+		if c.env.jsonFieldNames && !ft.IsJSONField {
+			c.errors.undefinedField(exprID, c.locationByID(exprID), fieldName)
+		}
 		return ft.Type, found
 	}
 
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/checker/cost.go /work/src/external-provisioner/vendor/github.com/google/cel-go/checker/cost.go
--- a/vendor/github.com/google/cel-go/checker/cost.go	2026-09-05 00:02:32.066804322 +0000
+++ b/vendor/github.com/google/cel-go/checker/cost.go	2026-09-05 00:03:03.430974577 +0000
@@ -159,6 +159,11 @@
 	return result
 }
 
+// AsCost converts a size estimates to an equivalent cost estimate.
+func (se SizeEstimate) AsCost() CostEstimate {
+	return se.MultiplyByCostFactor(1)
+}
+
 // CostEstimate represents an estimated cost range and provides add and multiply operations
 // that do not overflow.
 type CostEstimate struct {
@@ -786,18 +791,26 @@
 			return CallEstimate{CostEstimate: c.sizeOrUnknown(args[1]).MultiplyByCostFactor(1).Add(argCostSum())}
 		}
 	// O(nm) functions
-	case overloads.MatchesString:
+	case overloads.Matches, overloads.MatchesString:
 		// https://swtch.com/~rsc/regexp/regexp1.html applies to RE2 implementation supported by CEL
-		if target != nil && len(args) == 1 {
+		var strNode, regexNode AstNode
+		if overloadID == overloads.MatchesString && target != nil && len(args) == 1 {
+			strNode = *target
+			regexNode = args[0]
+		} else if overloadID == overloads.Matches && target == nil && len(args) == 2 {
+			strNode = args[0]
+			regexNode = args[1]
+		}
+		if strNode != nil && regexNode != nil {
 			// Add one to string length for purposes of cost calculation to prevent product of string and regex to be 0
 			// in case where string is empty but regex is still expensive.
-			strCost := c.sizeOrUnknown(*target).Add(SizeEstimate{Min: 1, Max: 1}).MultiplyByCostFactor(common.StringTraversalCostFactor)
+			strCost := c.sizeOrUnknown(strNode).Add(SizeEstimate{Min: 1, Max: 1}).MultiplyByCostFactor(common.StringTraversalCostFactor)
 			// We don't know how many expressions are in the regex, just the string length (a huge
 			// improvement here would be to somehow get a count the number of expressions in the regex or
 			// how many states are in the regex state machine and use that to measure regex cost).
 			// For now, we're making a guess that each expression in a regex is typically at least 4 chars
 			// in length.
-			regexCost := c.sizeOrUnknown(args[0]).MultiplyByCostFactor(common.RegexStringLengthCostFactor)
+			regexCost := c.sizeOrUnknown(regexNode).MultiplyByCostFactor(common.RegexStringLengthCostFactor)
 			return CallEstimate{CostEstimate: strCost.Multiply(regexCost).Add(argCostSum())}
 		}
 	case overloads.ContainsString:
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/checker/env.go /work/src/external-provisioner/vendor/github.com/google/cel-go/checker/env.go
--- a/vendor/github.com/google/cel-go/checker/env.go	2026-09-05 00:02:32.066804322 +0000
+++ b/vendor/github.com/google/cel-go/checker/env.go	2026-09-05 00:03:03.430974577 +0000
@@ -74,6 +74,7 @@
 	declarations        *Scopes
 	aggLitElemType      aggregateLiteralElementType
 	filteredOverloadIDs map[string]struct{}
+	jsonFieldNames      bool
 }
 
 // NewEnv returns a new *Env with the given parameters.
@@ -104,6 +105,7 @@
 		declarations:        declarations,
 		aggLitElemType:      aggLitElemType,
 		filteredOverloadIDs: filteredOverloadIDs,
+		jsonFieldNames:      envOptions.jsonFieldNames,
 	}, nil
 }
 
@@ -273,12 +275,31 @@
 	return errMsgs
 }
 
+func maybeMergeConstant(a *decls.VariableDecl, b *decls.VariableDecl) (*decls.VariableDecl, errorMsg) {
+	if b.Value() != nil {
+		if a.Value() == nil {
+			return b, ""
+		}
+		eq, ok := a.Value().Equal(b.Value()).Value().(bool)
+		if ok && eq {
+			return a, ""
+		}
+		return nil, constantConflictError(b.Name())
+	}
+	return a, ""
+}
+
 // addIdent adds the Decl to the declarations in the Env.
 // Returns a non-empty errorMsg if the identifier is already declared in the scope.
 func (e *Env) addIdent(decl *decls.VariableDecl) errorMsg {
 	current := e.declarations.FindIdentInScope(decl.Name())
 	if current != nil {
 		if current.DeclarationIsEquivalent(decl) {
+			decl, errMsg := maybeMergeConstant(current, decl)
+			if errMsg != "" {
+				return errMsg
+			}
+			e.declarations.AddIdent(decl)
 			return ""
 		}
 		return overlappingIdentifierError(decl.Name())
@@ -325,6 +346,10 @@
 // may be accumulated into an error at a later point in execution.
 type errorMsg string
 
+func constantConflictError(name string) errorMsg {
+	return errorMsg(fmt.Sprintf("conflicting constant definitions for name '%s'", name))
+}
+
 func overlappingIdentifierError(name string) errorMsg {
 	return errorMsg(fmt.Sprintf("overlapping identifier for name '%s'", name))
 }
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/checker/options.go /work/src/external-provisioner/vendor/github.com/google/cel-go/checker/options.go
--- a/vendor/github.com/google/cel-go/checker/options.go	2026-09-05 00:02:32.066804322 +0000
+++ b/vendor/github.com/google/cel-go/checker/options.go	2026-09-05 00:03:03.430974577 +0000
@@ -18,6 +18,7 @@
 	crossTypeNumericComparisons  bool
 	homogeneousAggregateLiterals bool
 	validatedDeclarations        *Scopes
+	jsonFieldNames               bool
 }
 
 // Option is a functional option for configuring the type-checker
@@ -40,3 +41,11 @@
 		return nil
 	}
 }
+
+// JSONFieldNames enables the use of json names instead of the standard protobuf snake_case field names
+func JSONFieldNames(enabled bool) Option {
+	return func(opts *options) error {
+		opts.jsonFieldNames = enabled
+		return nil
+	}
+}
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/common/ast/ast.go /work/src/external-provisioner/vendor/github.com/google/cel-go/common/ast/ast.go
--- a/vendor/github.com/google/cel-go/common/ast/ast.go	2026-09-05 00:02:32.066804322 +0000
+++ b/vendor/github.com/google/cel-go/common/ast/ast.go	2026-09-05 00:03:03.430974577 +0000
@@ -231,6 +231,11 @@
 	for id, call := range info.macroCalls {
 		callsCopy[id] = defaultFactory.CopyExpr(call)
 	}
+	var extCopy []Extension
+	if len(info.extensions) > 0 {
+		extCopy = make([]Extension, len(info.extensions))
+		copy(extCopy, info.extensions)
+	}
 	return &SourceInfo{
 		syntax:       info.syntax,
 		desc:         info.desc,
@@ -239,6 +244,7 @@
 		baseCol:      info.baseCol,
 		offsetRanges: rangesCopy,
 		macroCalls:   callsCopy,
+		extensions:   extCopy,
 	}
 }
 
@@ -252,6 +258,9 @@
 	baseCol      int32
 	offsetRanges map[int64]OffsetRange
 	macroCalls   map[int64]Expr
+
+	// extensions indicate versioned optional features which affect the execution of one or more CEL component.
+	extensions []Extension
 }
 
 // RenumberIDs performs an in-place update of the expression IDs within the SourceInfo.
@@ -420,6 +429,34 @@
 	return offset + col
 }
 
+// Extensions returns the set of extensions present in the source.
+func (s *SourceInfo) Extensions() []Extension {
+	var extensions []Extension
+	if s == nil {
+		return extensions
+	}
+	return s.extensions
+}
+
+// HasExtension returns whether the source info contains the extension which satisfies the minimum version requirement.
+//
+// For an extension to be considered 'present' it must have the same major version as the minVersion and a minor version
+// at least as great as the lowest minor version specified.
+func (s *SourceInfo) HasExtension(id string, minVersion ExtensionVersion) bool {
+	for _, ext := range s.Extensions() {
+		return ext.ID == id && ext.Version.Major == minVersion.Major && ext.Version.Minor >= minVersion.Minor
+	}
+	return false
+}
+
+// AddExtension adds an extension record into the SourceInfo.
+func (s *SourceInfo) AddExtension(ext Extension) {
+	if s == nil {
+		return
+	}
+	s.extensions = append(s.extensions, ext)
+}
+
 // OffsetRange captures the start and stop positions of a section of text in the input expression.
 type OffsetRange struct {
 	Start int32
@@ -489,6 +526,53 @@
 	return true
 }
 
+// NewExtension creates an Extension to be recorded on the SourceInfo.
+func NewExtension(id string, version ExtensionVersion, components ...ExtensionComponent) Extension {
+	return Extension{
+		ID:         id,
+		Version:    version,
+		Components: components,
+	}
+}
+
+// Extension represents a versioned, optional feature present in the AST that affects CEL component behavior.
+type Extension struct {
+	// ID indicates the unique name of the extension.
+	ID string
+	// Version indicates the major / minor version.
+	Version ExtensionVersion
+	// Components enumerates the CEL components affected by the feature.
+	Components []ExtensionComponent
+}
+
+// NewExtensionVersion creates a new extension version with a major, minor version.
+func NewExtensionVersion(major, minor int64) ExtensionVersion {
+	return ExtensionVersion{Major: major, Minor: minor}
+}
+
+// ExtensionVersion represents a semantic version with a major and minor number.
+type ExtensionVersion struct {
+	// Major version of the extension.
+	// All versions with the same major number are expected to be compatible with all minor version changes.
+	Major int64
+
+	// Minor version of the extension which indicates that some small non-semantic change has been made to
+	// the extension.
+	Minor int64
+}
+
+// ExtensionComponent indicates which CEL component is affected.
+type ExtensionComponent int
+
+const (
+	// ComponentParser means the feature affects expression parsing.
+	ComponentParser ExtensionComponent = iota + 1
+	// ComponentTypeChecker means the feature affects type-checking.
+	ComponentTypeChecker
+	// ComponentRuntime alters program planning or evaluation of the AST.
+	ComponentRuntime
+)
+
 type maxIDVisitor struct {
 	maxID int64
 	*baseVisitor
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/common/ast/conversion.go /work/src/external-provisioner/vendor/github.com/google/cel-go/common/ast/conversion.go
--- a/vendor/github.com/google/cel-go/common/ast/conversion.go	2026-09-05 00:02:32.066804322 +0000
+++ b/vendor/github.com/google/cel-go/common/ast/conversion.go	2026-09-05 00:03:03.430974577 +0000
@@ -27,6 +27,19 @@
 	structpb "google.golang.org/protobuf/types/known/structpb"
 )
 
+var (
+	pbComponentMap = map[exprpb.SourceInfo_Extension_Component]ExtensionComponent{
+		exprpb.SourceInfo_Extension_COMPONENT_PARSER:       ComponentParser,
+		exprpb.SourceInfo_Extension_COMPONENT_TYPE_CHECKER: ComponentTypeChecker,
+		exprpb.SourceInfo_Extension_COMPONENT_RUNTIME:      ComponentRuntime,
+	}
+	componentPBMap = map[ExtensionComponent]exprpb.SourceInfo_Extension_Component{
+		ComponentParser:      exprpb.SourceInfo_Extension_COMPONENT_PARSER,
+		ComponentTypeChecker: exprpb.SourceInfo_Extension_COMPONENT_TYPE_CHECKER,
+		ComponentRuntime:     exprpb.SourceInfo_Extension_COMPONENT_RUNTIME,
+	}
+)
+
 // ToProto converts an AST to a CheckedExpr protobouf.
 func ToProto(ast *AST) (*exprpb.CheckedExpr, error) {
 	refMap := make(map[int64]*exprpb.Reference, len(ast.ReferenceMap()))
@@ -534,6 +547,25 @@
 		}
 		sourceInfo.MacroCalls[id] = call
 	}
+	for _, ext := range info.Extensions() {
+		var components []exprpb.SourceInfo_Extension_Component
+		for _, c := range ext.Components {
+			comp, found := componentPBMap[c]
+			if found {
+				components = append(components, comp)
+			}
+		}
+		ver := &exprpb.SourceInfo_Extension_Version{
+			Major: ext.Version.Major,
+			Minor: ext.Version.Minor,
+		}
+		pbExt := &exprpb.SourceInfo_Extension{
+			Id:                 ext.ID,
+			Version:            ver,
+			AffectedComponents: components,
+		}
+		sourceInfo.Extensions = append(sourceInfo.Extensions, pbExt)
+	}
 	return sourceInfo, nil
 }
 
@@ -556,6 +588,23 @@
 		}
 		sourceInfo.SetMacroCall(id, call)
 	}
+	for _, pbExt := range info.GetExtensions() {
+		var components []ExtensionComponent
+		for _, c := range pbExt.GetAffectedComponents() {
+			comp, found := pbComponentMap[*c.Enum()]
+			if found {
+				components = append(components, comp)
+			}
+		}
+		sourceInfo.AddExtension(NewExtension(
+			pbExt.GetId(),
+			NewExtensionVersion(
+				pbExt.GetVersion().GetMajor(),
+				pbExt.GetVersion().GetMinor(),
+			),
+			components...,
+		))
+	}
 	return sourceInfo, nil
 }
 
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/common/containers/container.go /work/src/external-provisioner/vendor/github.com/google/cel-go/common/containers/container.go
--- a/vendor/github.com/google/cel-go/common/containers/container.go	2026-09-05 00:02:32.066804322 +0000
+++ b/vendor/github.com/google/cel-go/common/containers/container.go	2026-09-05 00:03:03.430974577 +0000
@@ -227,7 +227,7 @@
 			}
 			alias := qn[ind+1:]
 			var err error
-			c, err = aliasAs("abbreviation", qn, alias)(c)
+			c, err = aliasAs("abbreviation", qn, alias, true)(c)
 			if err != nil {
 				return nil, err
 			}
@@ -236,31 +236,32 @@
 	}
 }
 
-// Alias associates a fully-qualified name with a user-defined alias.
+// Alias associates a name with a user-defined alias.
 //
 // In general, Abbrevs is preferred to Alias since the names generated from the Abbrevs option
 // are more easily traced back to source code. The Alias option is useful for propagating alias
 // configuration from one Container instance to another, and may also be useful for remapping
 // poorly chosen protobuf message / package names.
-//
-// Note: all of the rules that apply to Abbrevs also apply to Alias.
 func Alias(qualifiedName, alias string) ContainerOption {
-	return aliasAs("alias", qualifiedName, alias)
+	return aliasAs("alias", qualifiedName, alias, false)
 }
 
-func aliasAs(kind, qualifiedName, alias string) ContainerOption {
+func aliasAs(kind, qualifiedName, alias string, requireQualified bool) ContainerOption {
 	return func(c *Container) (*Container, error) {
 		if len(alias) == 0 || strings.Contains(alias, ".") {
 			return nil, fmt.Errorf(
 				"%s must be non-empty and simple (not qualified): %s=%s", kind, kind, alias)
 		}
 
+		if len(qualifiedName) == 0 {
+			return nil, fmt.Errorf("%s must refer to a valid name: %s", kind, qualifiedName)
+		}
 		if qualifiedName[0:1] == "." {
 			return nil, fmt.Errorf("qualified name must not begin with a leading '.': %s",
 				qualifiedName)
 		}
 		ind := strings.LastIndex(qualifiedName, ".")
-		if ind <= 0 || ind == len(qualifiedName)-1 {
+		if ind == len(qualifiedName)-1 || (requireQualified && ind <= 0) {
 			return nil, fmt.Errorf("%s must refer to a valid qualified name: %s",
 				kind, qualifiedName)
 		}
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/common/decls/decls.go /work/src/external-provisioner/vendor/github.com/google/cel-go/common/decls/decls.go
--- a/vendor/github.com/google/cel-go/common/decls/decls.go	2026-09-05 00:02:32.066804322 +0000
+++ b/vendor/github.com/google/cel-go/common/decls/decls.go	2026-09-05 00:03:03.430974577 +0000
@@ -270,7 +270,7 @@
 		if oID == overload.ID() {
 			if o.SignatureEquals(overload) && o.IsNonStrict() == overload.IsNonStrict() {
 				// Allow redefinition of an overload implementation so long as the signatures match.
-				if overload.hasBinding() {
+				if overload.HasBinding() {
 					f.overloads[oID] = overload
 				}
 				// Allow redefinition of the doc string.
@@ -303,6 +303,14 @@
 	return overloads
 }
 
+// HasSingletonBinding indicates whether the function has a singleton binding definition.
+func (f *FunctionDecl) HasSingletonBinding() bool {
+	if f == nil {
+		return false
+	}
+	return f.singleton != nil
+}
+
 // HasLateBinding returns true if the function has late bindings. A function cannot mix late bindings with other bindings.
 func (f *FunctionDecl) HasLateBinding() bool {
 	if f == nil {
@@ -328,7 +336,7 @@
 	for _, oID := range f.overloadOrdinals {
 		o := f.overloads[oID]
 		hasLateBinding = hasLateBinding || o.HasLateBinding()
-		if o.hasBinding() {
+		if o.HasBinding() {
 			overload := &functions.Overload{
 				Operator:     o.ID(),
 				Unary:        o.guardedUnaryOp(f.Name(), f.disableTypeGuards),
@@ -740,8 +748,8 @@
 	return argsOverlap
 }
 
-// hasBinding indicates whether the overload already has a definition.
-func (o *OverloadDecl) hasBinding() bool {
+// HasBinding indicates whether the overload already has a definition.
+func (o *OverloadDecl) HasBinding() bool {
 	return o != nil && (o.unaryOp != nil || o.binaryOp != nil || o.functionOp != nil)
 }
 
@@ -842,7 +850,7 @@
 // type-guard which ensures runtime type agreement between the overload signature and runtime argument types.
 func UnaryBinding(binding functions.UnaryOp) OverloadOpt {
 	return func(o *OverloadDecl) (*OverloadDecl, error) {
-		if o.hasBinding() {
+		if o.HasBinding() {
 			return nil, fmt.Errorf("overload already has a binding: %s", o.ID())
 		}
 		if len(o.ArgTypes()) != 1 {
@@ -860,7 +868,7 @@
 // type-guard which ensures runtime type agreement between the overload signature and runtime argument types.
 func BinaryBinding(binding functions.BinaryOp) OverloadOpt {
 	return func(o *OverloadDecl) (*OverloadDecl, error) {
-		if o.hasBinding() {
+		if o.HasBinding() {
 			return nil, fmt.Errorf("overload already has a binding: %s", o.ID())
 		}
 		if len(o.ArgTypes()) != 2 {
@@ -878,7 +886,7 @@
 // type-guard which ensures runtime type agreement between the overload signature and runtime argument types.
 func FunctionBinding(binding functions.FunctionOp) OverloadOpt {
 	return func(o *OverloadDecl) (*OverloadDecl, error) {
-		if o.hasBinding() {
+		if o.HasBinding() {
 			return nil, fmt.Errorf("overload already has a binding: %s", o.ID())
 		}
 		if o.hasLateBinding {
@@ -893,7 +901,7 @@
 // This is useful for functions which have side-effects or are not deterministically computable.
 func LateFunctionBinding() OverloadOpt {
 	return func(o *OverloadDecl) (*OverloadDecl, error) {
-		if o.hasBinding() {
+		if o.HasBinding() {
 			return nil, fmt.Errorf("overload already has a binding: %s", o.ID())
 		}
 		o.hasLateBinding = true
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/common/doc.go /work/src/external-provisioner/vendor/github.com/google/cel-go/common/doc.go
--- a/vendor/github.com/google/cel-go/common/doc.go	2026-09-05 00:02:32.070804342 +0000
+++ b/vendor/github.com/google/cel-go/common/doc.go	2026-09-05 00:03:03.430974577 +0000
@@ -37,6 +37,8 @@
 	DocMacro
 	// DocExample represents example documentation.
 	DocExample
+	// DocField represents documentation for a struct field.
+	DocField
 )
 
 // Doc holds the documentation details for a specific program element like
@@ -163,6 +165,17 @@
 	}
 }
 
+// NewFieldDoc creates a new Doc struct for documenting a struct field.
+func NewFieldDoc(name, celType, description string, examples ...*Doc) *Doc {
+	return &Doc{
+		Kind:        DocField,
+		Name:        name,
+		Type:        celType,
+		Description: description,
+		Children:    examples,
+	}
+}
+
 // Documentor is an interface for types that can provide their own documentation.
 type Documentor interface {
 	// Documentation returns the documentation coded by the DocKind to assist
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/common/env/BUILD.bazel /work/src/external-provisioner/vendor/github.com/google/cel-go/common/env/BUILD.bazel
--- a/vendor/github.com/google/cel-go/common/env/BUILD.bazel	2026-09-05 00:02:32.070804342 +0000
+++ b/vendor/github.com/google/cel-go/common/env/BUILD.bazel	2026-09-05 00:03:03.430974577 +0000
@@ -23,12 +23,14 @@
     name = "go_default_library",
     srcs = [
         "env.go",
+        "io.go",
     ],
     importpath = "github.com/google/cel-go/common/env",
     deps = [
         "//common:go_default_library",
         "//common/decls:go_default_library",
         "//common/types:go_default_library",
+        "@in_yaml_go_yaml_v3//:go_default_library",
     ],
 )
 
@@ -37,6 +39,7 @@
     size = "small",
     srcs = [
         "env_test.go",
+        "io_test.go",
     ],
     data = glob(["testdata/**"]),
     embed = [":go_default_library"],
@@ -45,6 +48,7 @@
         "//common/operators:go_default_library",
         "//common/overloads:go_default_library",
         "//common/types:go_default_library",
+        "@com_github_google_go_cmp//cmp:go_default_library",
         "@in_yaml_go_yaml_v3//:go_default_library",
     ],
 )
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/common/env/env.go /work/src/external-provisioner/vendor/github.com/google/cel-go/common/env/env.go
--- a/vendor/github.com/google/cel-go/common/env/env.go	2026-09-05 00:02:32.070804342 +0000
+++ b/vendor/github.com/google/cel-go/common/env/env.go	2026-09-05 00:03:03.430974577 +0000
@@ -50,6 +50,7 @@
 	Functions       []*Function      `yaml:"functions,omitempty"`
 	Validators      []*Validator     `yaml:"validators,omitempty"`
 	Features        []*Feature       `yaml:"features,omitempty"`
+	Limits          []*Limit         `yaml:"limits,omitempty"`
 }
 
 // Validate validates the whole configuration is well-formed.
@@ -92,6 +93,11 @@
 			errs = append(errs, err)
 		}
 	}
+	for _, limit := range c.Limits {
+		if err := limit.Validate(); err != nil {
+			errs = append(errs, err)
+		}
+	}
 	for _, val := range c.Validators {
 		if err := val.Validate(); err != nil {
 			errs = append(errs, err)
@@ -206,6 +212,12 @@
 	return c
 }
 
+// AddLimits appends one or more limits to the config.
+func (c *Config) AddLimits(limits ...*Limit) *Config {
+	c.Limits = append(c.Limits, limits...)
+	return c
+}
+
 // NewImport returns a serializable import value from the qualified type name.
 func NewImport(name string) *Import {
 	return &Import{Name: name}
@@ -246,7 +258,9 @@
 
 	// Type represents the type declaration for the variable.
 	//
-	// Deprecated: use the embedded *TypeDesc fields directly.
+	// When serialized, 'type' is used for shorthand specifier string.
+	//
+	// Use GetType() for getting the effective type.
 	Type *TypeDesc `yaml:"type,omitempty"`
 
 	// TypeDesc is an embedded set of fields allowing for the specification of the Variable type.
@@ -264,6 +278,9 @@
 	if err := v.GetType().Validate(); err != nil {
 		return fmt.Errorf("invalid variable %q: %w", v.Name, err)
 	}
+	if v.GetType().IsTypeParam {
+		return fmt.Errorf("invalid variable %q: variables cannot be type parameters", v.Name)
+	}
 	return nil
 }
 
@@ -734,6 +751,29 @@
 	return nil
 }
 
+// Limit represents a named limit in the CEL environment. This is used to control
+// the complexity tolerated before failing parsing, type checking, or planning.
+type Limit struct {
+	Name  string `yaml:"name"`
+	Value int    `yaml:"value"`
+}
+
+// NewLimit creates a new limit.
+func NewLimit(name string, value int) *Limit {
+	return &Limit{name, value}
+}
+
+// Validate validates a limit.
+func (l *Limit) Validate() error {
+	if l == nil {
+		return errors.New("invalid limit: nil")
+	}
+	if l.Name == "" {
+		return errors.New("invalid limit: missing name")
+	}
+	return nil
+}
+
 // NewTypeDesc describes a simple or complex type with parameters.
 func NewTypeDesc(typeName string, params ...*TypeDesc) *TypeDesc {
 	return &TypeDesc{TypeName: typeName, Params: params}
@@ -796,11 +836,47 @@
 			return fmt.Errorf("invalid type: optional_type expects 1 parameter, got %d", len(td.Params))
 		}
 		return td.Params[0].Validate()
+	case "type":
+		if len(td.Params) == 0 {
+			return nil
+		}
+		if len(td.Params) != 1 {
+			return fmt.Errorf("invalid type: type expects 0 or 1 parameters, got %d", len(td.Params))
+		}
+		return td.Params[0].Validate()
 	default:
 	}
 	return nil
 }
 
+func formatSpecifierImpl(td *TypeDesc, sb *strings.Builder) {
+	if td.IsTypeParam {
+		sb.WriteRune('~')
+		sb.WriteString(td.TypeName)
+		return
+	}
+	sb.WriteString(td.TypeName)
+	l := len(td.Params)
+	if l < 1 {
+		return
+	}
+	sb.WriteRune('<')
+	for i, p := range td.Params {
+		formatSpecifierImpl(p, sb)
+		if i < l-1 {
+			sb.WriteString(", ")
+		}
+	}
+	sb.WriteRune('>')
+}
+
+// SpecifierFormat returns the short text representation of the type. e.g. "map<string, int>"
+func (td *TypeDesc) SpecifierFormat() string {
+	var sb strings.Builder
+	formatSpecifierImpl(td, &sb)
+	return sb.String()
+}
+
 // AsCELType converts the serializable object to a *types.Type value.
 func (td *TypeDesc) AsCELType(tp types.Provider) (*types.Type, error) {
 	err := td.Validate()
@@ -810,6 +886,27 @@
 	switch td.TypeName {
 	case "dyn":
 		return types.DynType, nil
+	// short aliases for WKTs
+	case "duration":
+		return types.DurationType, nil
+	case "timestamp":
+		return types.TimestampType, nil
+	case "any":
+		return types.AnyType, nil
+	case "null", "null_type":
+		return types.NullType, nil
+	case "bool_wrapper":
+		return types.NewNullableType(types.BoolType), nil
+	case "bytes_wrapper":
+		return types.NewNullableType(types.BytesType), nil
+	case "double_wrapper":
+		return types.NewNullableType(types.DoubleType), nil
+	case "int_wrapper":
+		return types.NewNullableType(types.IntType), nil
+	case "uint_wrapper":
+		return types.NewNullableType(types.UintType), nil
+	case "string_wrapper":
+		return types.NewNullableType(types.StringType), nil
 	case "map":
 		kt, err := td.Params[0].AsCELType(tp)
 		if err != nil {
@@ -832,6 +929,15 @@
 			return nil, err
 		}
 		return types.NewOptionalType(et), nil
+	case "type":
+		if len(td.Params) == 0 {
+			return types.TypeType, nil
+		}
+		pt, err := td.Params[0].AsCELType(tp)
+		if err != nil {
+			return nil, err
+		}
+		return types.NewTypeTypeWithParam(pt), nil
 	default:
 		if td.IsTypeParam {
 			return types.NewTypeParamType(td.TypeName), nil
@@ -874,6 +980,15 @@
 	for _, p := range t.Parameters() {
 		params = append(params, SerializeTypeDesc(p))
 	}
+	// Special types, these aren't useful for describing environments.
+	switch t.Kind() {
+	case types.ErrorKind:
+		typeName = "*error*"
+	case types.UnknownKind:
+		typeName = "*unknown*"
+	case types.UnspecifiedKind:
+		typeName = "*unspecified type*"
+	}
 	return NewTypeDesc(typeName, params...)
 }
 
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/common/env/io.go /work/src/external-provisioner/vendor/github.com/google/cel-go/common/env/io.go
--- a/vendor/github.com/google/cel-go/common/env/io.go	1970-01-01 00:00:00.000000000 +0000
+++ b/vendor/github.com/google/cel-go/common/env/io.go	2026-09-05 00:03:03.430974577 +0000
@@ -0,0 +1,271 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package env
+
+import (
+	"errors"
+	"fmt"
+
+	"go.yaml.in/yaml/v3"
+)
+
+type internalTypeDesc struct {
+	TypeName    string      `yaml:"type_name"`
+	Params      []*TypeDesc `yaml:"params,omitempty"`
+	IsTypeParam bool        `yaml:"is_type_param,omitempty"`
+}
+
+// Embedding TypeDesc in variable causes issues with customizing
+// unmarshalling / marshalling. Work around with a parallel type.
+type internalVariable struct {
+	Name        string `yaml:"name"`
+	Description string `yaml:"description,omitempty"`
+
+	// Type represents the type declaration for the variable.
+	Type *TypeDesc `yaml:"type,omitempty"`
+
+	TypeName    string      `yaml:"type_name"`
+	Params      []*TypeDesc `yaml:"params,omitempty"`
+	IsTypeParam bool        `yaml:"is_type_param,omitempty"`
+}
+
+// UnmarshalYAML implements yaml.Unmarshal
+func (v *Variable) UnmarshalYAML(n *yaml.Node) error {
+	buf := internalVariable{}
+	err := n.Decode(&buf)
+	if err != nil {
+		return err
+	}
+	v.Name = buf.Name
+	v.Description = buf.Description
+	if buf.TypeName != "" {
+		v.TypeDesc = &TypeDesc{
+			TypeName:    buf.TypeName,
+			Params:      buf.Params,
+			IsTypeParam: buf.IsTypeParam,
+		}
+	} else if buf.Type != nil {
+		v.TypeDesc = buf.Type
+	}
+	return nil
+}
+
+// MarshalYAML implements yaml.Marshaler
+func (v *Variable) MarshalYAML() (any, error) {
+	// The presence of an unmarshaller alters the default marshaller behavior so
+	// provide a simple marshal implementation.
+	buf := internalVariable{
+		Name:        v.Name,
+		Description: v.Description,
+	}
+	if t := v.GetType(); t != nil {
+		buf.TypeName = t.TypeName
+		buf.Params = t.Params
+		buf.IsTypeParam = t.IsTypeParam
+	}
+	return &buf, nil
+}
+
+// UnmarshalYAML implements yaml.Unmarshaler
+func (td *TypeDesc) UnmarshalYAML(n *yaml.Node) error {
+	if td == nil {
+		return fmt.Errorf("unexpected Unmarshal for TypeDesc at: %d", n.Line)
+	}
+	if n.Kind == yaml.ScalarNode {
+		o, err := ParseTypeDesc(n.Value)
+		if err != nil {
+			return err
+		}
+		*td = *o
+		return nil
+	}
+
+	if n.Kind != yaml.MappingNode {
+		return errors.New("unsupported yaml for TypeDesc")
+	}
+
+	buf := internalTypeDesc{}
+	err := n.Decode(&buf)
+	if err != nil {
+		return err
+	}
+	td.TypeName = buf.TypeName
+	td.Params = buf.Params
+	td.IsTypeParam = buf.IsTypeParam
+	return nil
+}
+
+type typeDescParser struct {
+	text   string
+	pos    int
+	length int
+}
+
+// ParseTypeDesc parses a TypeDesc from the type specifier format: "map<string, int>"
+func ParseTypeDesc(text string) (*TypeDesc, error) {
+	p := &typeDescParser{text: text, length: len(text)}
+	res, err := p.parseTypeElem()
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse type %q: %v", text, err)
+	}
+	p.skipWhitespace()
+	if p.pos < p.length {
+		return nil, fmt.Errorf("unexpected character %q at position %d in %q", p.text[p.pos], p.pos, text)
+	}
+	return res, nil
+}
+
+func (p *typeDescParser) parseConcreteType() (*TypeDesc, error) {
+	id, err := p.parseNamespaceIdentifier()
+	if err != nil {
+		return nil, err
+	}
+	if p.pos < p.length && p.text[p.pos] == '<' {
+		p.pos++ // consume '<'
+		var params []*TypeDesc
+		for {
+			p.skipWhitespace()
+			param, err := p.parseTypeElem()
+			if err != nil {
+				return nil, err
+			}
+			params = append(params, param)
+			p.skipWhitespace()
+			if p.pos < p.length && p.text[p.pos] == ',' {
+				p.pos++ // consume ','
+				continue
+			}
+			if p.pos < p.length && p.text[p.pos] == '>' {
+				p.pos++ // consume '>'
+				break
+			}
+			return nil, fmt.Errorf("expected ',' or '>' at position %d", p.pos)
+		}
+		return NewTypeDesc(id, params...), nil
+	}
+	return NewTypeDesc(id), nil
+}
+
+func (p *typeDescParser) parseTypeElem() (*TypeDesc, error) {
+	p.skipWhitespace()
+	if p.pos < p.length && p.text[p.pos] == '~' {
+		p.pos++ // consume '~'
+		id, err := p.parseTypeParamIdent()
+		if err != nil {
+			return nil, err
+		}
+		return NewTypeParam(id), nil
+	}
+	return p.parseConcreteType()
+}
+
+func (p *typeDescParser) parseNamespaceIdentifier() (string, error) {
+	p.skipWhitespace()
+	var id string
+	for p.pos < p.length && p.text[p.pos] != '<' {
+		c := p.text[p.pos]
+		if c == '.' {
+			id += "."
+			p.pos++ // consume '.'
+		}
+		ident, err := p.parseIdentifier()
+		if err != nil {
+			return "", err
+		}
+		id += ident
+		p.skipWhitespace()
+		if p.pos < p.length && p.text[p.pos] != '.' {
+			break
+		}
+	}
+	if id == "" {
+		return "", fmt.Errorf("missing identifier at position %d", p.pos)
+	}
+	return id, nil
+}
+
+func (p *typeDescParser) parseIdentifier() (string, error) {
+	p.skipWhitespace()
+	if p.pos >= p.length {
+		return "", fmt.Errorf("unexpected end of input")
+	}
+	start := p.pos
+	c := p.text[p.pos]
+	if !isAlpha(c) && c != '_' {
+		return "", fmt.Errorf("identifier is expected, but %q was found at position %d", c, p.pos)
+	}
+	p.pos++
+	for p.pos < p.length {
+		c := p.text[p.pos]
+		if !isAlphaNumeric(c) && c != '_' {
+			break
+		}
+		p.pos++
+	}
+	return p.text[start:p.pos], nil
+}
+
+func (p *typeDescParser) parseTypeParamIdent() (string, error) {
+	p.skipWhitespace()
+	if p.pos >= p.length {
+		return "", fmt.Errorf("unexpected end of input")
+	}
+	c := p.text[p.pos]
+	if !isAlpha(c) {
+		return "", fmt.Errorf("invalid type parameter identifier %q at position %d, must be a single character from A-Z", c, p.pos)
+	}
+	p.pos++
+	if p.pos < p.length && isAlpha(p.text[p.pos]) {
+		return "", fmt.Errorf("invalid type param, must have a single alphabetic character at position %d", p.pos)
+	}
+	return string(c), nil
+}
+
+func (p *typeDescParser) skipWhitespace() {
+	for p.pos < p.length && p.text[p.pos] == ' ' {
+		p.pos++
+	}
+}
+
+func isAlpha(c byte) bool {
+	return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z')
+}
+
+func isAlphaNumeric(c byte) bool {
+	return isAlpha(c) || (c >= '0' && c <= '9')
+}
+
+// ConfigFromYAML returns a config from YAML source.
+//
+// Adds custom parsing logic for normalizing shorthand for specifiying some fields
+// in a YAML document (mainly the type-specifier shorthand).
+//
+// Using yaml.Unmarshal with any implementation should be sufficient for most
+// cases.
+func ConfigFromYAML(data []byte) (*Config, error) {
+	c := &Config{}
+	e := yaml.Unmarshal(data, c)
+	if e != nil {
+		return nil, e
+	}
+	return c, nil
+}
+
+// ConfigToYAML returns the config serialized to YAML
+//
+// Provided as a convenience wrapper around a tested YAML Marshaler.
+func ConfigToYAML(c *Config) ([]byte, error) {
+	return yaml.Marshal(c)
+}
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/common/functions/functions.go /work/src/external-provisioner/vendor/github.com/google/cel-go/common/functions/functions.go
--- a/vendor/github.com/google/cel-go/common/functions/functions.go	2026-09-05 00:02:32.070804342 +0000
+++ b/vendor/github.com/google/cel-go/common/functions/functions.go	2026-09-05 00:03:03.434974597 +0000
@@ -15,7 +15,11 @@
 // Package functions defines the standard builtin functions supported by the interpreter
 package functions
 
-import "github.com/google/cel-go/common/types/ref"
+import (
+	"context"
+
+	"github.com/google/cel-go/common/types/ref"
+)
 
 // Overload defines a named overload of a function, indicating an operand trait
 // which must be present on the first argument to the overload as well as one
@@ -41,21 +45,37 @@
 	// Binary defines the overload with a BinaryOp implementation. May be nil.
 	Binary BinaryOp
 
-	// Function defines the overload with a FunctionOp implementation. May be
-	// nil.
+	// Function defines the overload with a FunctionOp implementation. May be nil.
 	Function FunctionOp
 
+	// Async defines the overload with an AsyncOp implementation. May be nil.
+	Async AsyncOp
+
 	// NonStrict specifies whether the Overload will tolerate arguments that
 	// are types.Err or types.Unknown.
 	NonStrict bool
 }
 
 // UnaryOp is a function that takes a single value and produces an output.
-type UnaryOp func(value ref.Val) ref.Val
+type UnaryOp func(ref.Val) ref.Val
 
 // BinaryOp is a function that takes two values and produces an output.
-type BinaryOp func(lhs ref.Val, rhs ref.Val) ref.Val
+type BinaryOp func(ref.Val, ref.Val) ref.Val
 
 // FunctionOp is a function with accepts zero or more arguments and produces
 // a value or error as a result.
-type FunctionOp func(values ...ref.Val) ref.Val
+type FunctionOp func(...ref.Val) ref.Val
+
+// AsyncOp is a function that accepts zero or more arguments and produces
+// a value or error asynchronously via a channel.
+//
+// AsyncOp is an internal interface intended for use by CEL to manage goroutines and
+// channels associated with async calls. For public API usage, use BlockingAsyncOp.
+// Implementers should listen for context cancellation on the provided context for
+// resource cleanup.
+type AsyncOp func(context.Context, ...ref.Val) <-chan ref.Val
+
+// BlockingAsyncOp is a function that accepts zero or more arguments and blocks until
+// the result is available. When used with AsyncBinding, the framework runs the function
+// in its own goroutine and manages channel lifecycle internally.
+type BlockingAsyncOp func(context.Context, ...ref.Val) ref.Val
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/common/overloads/overloads.go /work/src/external-provisioner/vendor/github.com/google/cel-go/common/overloads/overloads.go
--- a/vendor/github.com/google/cel-go/common/overloads/overloads.go	2026-09-05 00:02:32.070804342 +0000
+++ b/vendor/github.com/google/cel-go/common/overloads/overloads.go	2026-09-05 00:03:03.434974597 +0000
@@ -291,7 +291,6 @@
 const (
 	DurationToDuration = "duration_to_duration"
 	StringToDuration   = "string_to_duration"
-	IntToDuration      = "int64_to_duration"
 )
 
 // Convert to dyn
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/common/runes/buffer.go /work/src/external-provisioner/vendor/github.com/google/cel-go/common/runes/buffer.go
--- a/vendor/github.com/google/cel-go/common/runes/buffer.go	2026-09-05 00:02:32.070804342 +0000
+++ b/vendor/github.com/google/cel-go/common/runes/buffer.go	2026-09-05 00:03:03.434974597 +0000
@@ -16,6 +16,7 @@
 package runes
 
 import (
+	"fmt"
 	"strings"
 	"unicode/utf8"
 )
@@ -113,45 +114,64 @@
 
 var nilBuffer = &emptyBuffer{}
 
+// SizeLimitError indicates that the input exceeded the configured code point limit.
+type SizeLimitError struct {
+	Size  int
+	Limit int
+}
+
+func (e *SizeLimitError) Error() string {
+	return fmt.Sprintf("expression code point size exceeds limit: size: %d, limit %d", e.Size, e.Limit)
+}
+
 // NewBuffer returns an efficient implementation of Buffer for the given text based on the ranges of
 // the encoded code points contained within.
-//
-// Code points are represented as an array of byte, uint16, or rune. This approach ensures that
-// each index represents a code point by itself without needing to use an array of rune. At first
-// we assume all code points are less than or equal to '\u007f'. If this holds true, the
-// underlying storage is a byte array containing only ASCII characters. If we encountered a code
-// point above this range but less than or equal to '\uffff' we allocate a uint16 array, copy the
-// elements of previous byte array to the uint16 array, and continue. If this holds true, the
-// underlying storage is a uint16 array containing only Unicode characters in the Basic Multilingual
-// Plane. If we encounter a code point above '\uffff' we allocate an rune array, copy the previous
-// elements of the byte or uint16 array, and continue. The underlying storage is an rune array
-// containing any Unicode character.
 func NewBuffer(data string) Buffer {
-	buf, _ := newBuffer(data, false)
+	buf, _, _ := newBufferWithLimit(data, false, -1)
 	return buf
 }
 
 // NewBufferAndLineOffsets returns an efficient implementation of Buffer for the given text based on
 // the ranges of the encoded code points contained within, as well as returning the line offsets.
-//
-// Code points are represented as an array of byte, uint16, or rune. This approach ensures that
-// each index represents a code point by itself without needing to use an array of rune. At first
-// we assume all code points are less than or equal to '\u007f'. If this holds true, the
-// underlying storage is a byte array containing only ASCII characters. If we encountered a code
-// point above this range but less than or equal to '\uffff' we allocate a uint16 array, copy the
-// elements of previous byte array to the uint16 array, and continue. If this holds true, the
-// underlying storage is a uint16 array containing only Unicode characters in the Basic Multilingual
-// Plane. If we encounter a code point above '\uffff' we allocate an rune array, copy the previous
-// elements of the byte or uint16 array, and continue. The underlying storage is an rune array
-// containing any Unicode character.
 func NewBufferAndLineOffsets(data string) (Buffer, []int32) {
-	return newBuffer(data, true)
+	buf, offs, _ := newBufferWithLimit(data, true, -1)
+	return buf, offs
+}
+
+// NewBufferAndLineOffsetsWithLimit returns an efficient implementation of Buffer for the given text
+// and enforces a code point limit while constructing the buffer.
+func NewBufferAndLineOffsetsWithLimit(data string, limit int) (Buffer, []int32, error) {
+	if limit < 0 || len(data) <= limit {
+		return newBufferWithLimit(data, true, -1)
+	}
+	return newBufferWithLimit(data, true, limit)
+}
+
+func countRemainingCodePoints(data string, idx int, count int) int {
+	for idx < len(data) {
+		_, s := utf8.DecodeRuneInString(data[idx:])
+		idx += s
+		count++
+	}
+	return count
 }
 
-func newBuffer(data string, lines bool) (Buffer, []int32) {
+func newBufferWithLimit(data string, lines bool, limit int) (Buffer, []int32, error) {
 	if len(data) == 0 {
-		return nilBuffer, []int32{0}
+		return nilBuffer, []int32{0}, nil
 	}
+	if limit >= 0 && len(data) > limit {
+		size := countRemainingCodePoints(data, 0, 0)
+		if size > limit {
+			return nil, nil, &SizeLimitError{
+				Size:  size,
+				Limit: limit,
+			}
+		}
+	}
+
+	// The resulting buffers store one element per code point, so the worst case
+	// element count never exceeds len(data).
 	var (
 		idx         = 0
 		off   int32 = 0
@@ -195,7 +215,8 @@
 	}
 	return &asciiBuffer{
 		arr: buf8,
-	}, offs
+	}, offs, nil
+
 copy16:
 	for idx < len(data) {
 		r, s := utf8.DecodeRuneInString(data[idx:])
@@ -222,7 +243,8 @@
 	}
 	return &basicBuffer{
 		arr: buf16,
-	}, offs
+	}, offs, nil
+
 copy32:
 	for idx < len(data) {
 		r, s := utf8.DecodeRuneInString(data[idx:])
@@ -238,5 +260,5 @@
 	}
 	return &supplementalBuffer{
 		arr: buf32,
-	}, offs
+	}, offs, nil
 }
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/common/source.go /work/src/external-provisioner/vendor/github.com/google/cel-go/common/source.go
--- a/vendor/github.com/google/cel-go/common/source.go	2026-09-05 00:02:32.070804342 +0000
+++ b/vendor/github.com/google/cel-go/common/source.go	2026-09-05 00:03:03.430974577 +0000
@@ -74,6 +74,12 @@
 	return NewStringSource(text, "<input>")
 }
 
+// NewTextSourceWithLimit creates a new Source from the input text string while
+// enforcing a maximum code point count when needed.
+func NewTextSourceWithLimit(text string, limit int) (Source, error) {
+	return NewStringSourceWithLimit(text, "<input>", limit)
+}
+
 // NewStringSource creates a new Source from the given contents and description.
 func NewStringSource(contents string, description string) Source {
 	// Compute line offsets up front as they are referred to frequently.
@@ -85,6 +91,23 @@
 	}
 }
 
+// NewStringSourceWithLimit creates a new Source from the given contents and
+// description while enforcing a maximum code point count when needed.
+func NewStringSourceWithLimit(contents string, description string, limit int) (Source, error) {
+	if limit < 0 || len(contents) <= limit {
+		return NewStringSource(contents, description), nil
+	}
+	buf, offs, err := runes.NewBufferAndLineOffsetsWithLimit(contents, limit)
+	if err != nil {
+		return nil, err
+	}
+	return &sourceImpl{
+		Buffer:      buf,
+		description: description,
+		lineOffsets: offs,
+	}, nil
+}
+
 // NewInfoSource creates a new Source from a SourceInfo.
 func NewInfoSource(info *exprpb.SourceInfo) Source {
 	return &sourceImpl{
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/common/stdlib/standard.go /work/src/external-provisioner/vendor/github.com/google/cel-go/common/stdlib/standard.go
--- a/vendor/github.com/google/cel-go/common/stdlib/standard.go	2026-09-05 00:02:32.070804342 +0000
+++ b/vendor/github.com/google/cel-go/common/stdlib/standard.go	2026-09-05 00:03:03.434974597 +0000
@@ -605,8 +605,6 @@
 			decls.Overload(overloads.DurationToDuration, argTypes(types.DurationType), types.DurationType,
 				decls.OverloadExamples(`duration(duration('1s')) // duration('1s')`),
 				decls.UnaryBinding(identity)),
-			decls.Overload(overloads.IntToDuration, argTypes(types.IntType), types.DurationType,
-				decls.UnaryBinding(convertToType(types.DurationType))),
 			decls.Overload(overloads.StringToDuration, argTypes(types.StringType), types.DurationType,
 				decls.OverloadExamples(`duration('1h2m3s') // duration('3723s')`),
 				decls.UnaryBinding(convertToType(types.DurationType)))),
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/common/types/err.go /work/src/external-provisioner/vendor/github.com/google/cel-go/common/types/err.go
--- a/vendor/github.com/google/cel-go/common/types/err.go	2026-09-05 00:02:32.070804342 +0000
+++ b/vendor/github.com/google/cel-go/common/types/err.go	2026-09-05 00:03:03.434974597 +0000
@@ -113,6 +113,9 @@
 
 // WrapErr wraps an existing Go error value into a CEL Err value.
 func WrapErr(err error) ref.Val {
+	if err, ok := err.(*Err); ok {
+		return err
+	}
 	return &Err{error: err}
 }
 
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/common/types/list.go /work/src/external-provisioner/vendor/github.com/google/cel-go/common/types/list.go
--- a/vendor/github.com/google/cel-go/common/types/list.go	2026-09-05 00:02:32.070804342 +0000
+++ b/vendor/github.com/google/cel-go/common/types/list.go	2026-09-05 00:03:03.434974597 +0000
@@ -126,16 +126,7 @@
 	if !ok {
 		return MaybeNoSuchOverloadErr(other)
 	}
-	if l.Size() == IntZero {
-		return other
-	}
-	if otherList.Size() == IntZero {
-		return l
-	}
-	return &concatList{
-		Adapter:  l.Adapter,
-		prevList: l,
-		nextList: otherList}
+	return newConcatList(l.Adapter, l, otherList)
 }
 
 // Contains implements the traits.Container interface method.
@@ -353,9 +344,27 @@
 // The `Adapter` enables native type to CEL type conversions.
 type concatList struct {
 	Adapter
-	value    any
-	prevList traits.Lister
-	nextList traits.Lister
+	value      any
+	prevList   traits.Lister
+	nextList   traits.Lister
+	cachedSize ref.Val
+}
+
+func newConcatList(adapter Adapter, prevList, nextList traits.Lister) ref.Val {
+	prevSize := prevList.Size().(Int)
+	nextSize := nextList.Size().(Int)
+	if prevSize == IntZero {
+		return nextList.(ref.Val)
+	}
+	if nextSize == IntZero {
+		return prevList.(ref.Val)
+	}
+	return &concatList{
+		Adapter:    adapter,
+		prevList:   prevList,
+		nextList:   nextList,
+		cachedSize: prevSize.Add(nextSize),
+	}
 }
 
 // Add implements the traits.Adder interface method.
@@ -364,16 +373,7 @@
 	if !ok {
 		return MaybeNoSuchOverloadErr(other)
 	}
-	if l.Size() == IntZero {
-		return other
-	}
-	if otherList.Size() == IntZero {
-		return l
-	}
-	return &concatList{
-		Adapter:  l.Adapter,
-		prevList: l,
-		nextList: otherList}
+	return newConcatList(l.Adapter, l, otherList)
 }
 
 // Contains implements the traits.Container interface method.
@@ -477,7 +477,7 @@
 
 // Size implements the traits.Sizer interface method.
 func (l *concatList) Size() ref.Val {
-	return l.prevList.Size().(Int).Add(l.nextList.Size())
+	return l.cachedSize
 }
 
 // String converts the concatenated list to a human-readable string.
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/common/types/object.go /work/src/external-provisioner/vendor/github.com/google/cel-go/common/types/object.go
--- a/vendor/github.com/google/cel-go/common/types/object.go	2026-09-05 00:02:32.070804342 +0000
+++ b/vendor/github.com/google/cel-go/common/types/object.go	2026-09-05 00:03:03.434974597 +0000
@@ -187,8 +187,14 @@
 		if i > 0 {
 			sb.WriteString(", ")
 		}
-		sb.WriteString(fmt.Sprintf("%s: ", field.Name()))
-		formatTo(sb, o.Get(String(field.Name())))
+		name := String(field.Name())
+		if field.IsExtension() {
+			name = String(field.FullName())
+			fmt.Fprintf(sb, "`%s`: ", name)
+		} else {
+			fmt.Fprintf(sb, "%s: ", name)
+		}
+		formatTo(sb, o.Get(name))
 	}
 	sb.WriteString("}")
 }
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/common/types/optional.go /work/src/external-provisioner/vendor/github.com/google/cel-go/common/types/optional.go
--- a/vendor/github.com/google/cel-go/common/types/optional.go	2026-09-05 00:02:32.070804342 +0000
+++ b/vendor/github.com/google/cel-go/common/types/optional.go	2026-09-05 00:03:03.434974597 +0000
@@ -25,7 +25,7 @@
 
 var (
 	// OptionalType indicates the runtime type of an optional value.
-	OptionalType = NewOpaqueType("optional_type")
+	OptionalType = NewOpaqueType("optional_type", DynType)
 
 	// OptionalNone is a sentinel value which is used to indicate an empty optional value.
 	OptionalNone = &Optional{}
@@ -59,6 +59,9 @@
 	if !o.HasValue() {
 		return nil, errors.New("optional.none() dereference")
 	}
+	if typeDesc == reflect.TypeFor[*Optional]() {
+		return o, nil
+	}
 	return o.value.ConvertToNative(typeDesc)
 }
 
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/common/types/pb/file.go /work/src/external-provisioner/vendor/github.com/google/cel-go/common/types/pb/file.go
--- a/vendor/github.com/google/cel-go/common/types/pb/file.go	2026-09-05 00:02:32.070804342 +0000
+++ b/vendor/github.com/google/cel-go/common/types/pb/file.go	2026-09-05 00:03:03.438974618 +0000
@@ -32,7 +32,7 @@
 	}
 	types := make(map[string]*TypeDescription)
 	for name, msgType := range metadata.msgTypes {
-		types[name] = newTypeDescription(name, msgType, pbdb.extensions)
+		types[name] = newTypeDescription(name, msgType, pbdb)
 	}
 	fileExtMap := make(extensionMap)
 	for typeName, extensions := range metadata.msgExtensionMap {
@@ -42,12 +42,13 @@
 		}
 		for _, ext := range extensions {
 			extDesc := dynamicpb.NewExtensionType(ext).TypeDescriptor()
-			messageExtMap[string(ext.FullName())] = newFieldDescription(extDesc)
+			messageExtMap[string(ext.FullName())] = newFieldDescription(extDesc, pbdb.jsonFieldNames)
 		}
 		fileExtMap[typeName] = messageExtMap
 	}
 	return &FileDescription{
 		name:  fileDesc.Path(),
+		desc:  fileDesc,
 		types: types,
 		enums: enums,
 	}, fileExtMap
@@ -56,6 +57,7 @@
 // FileDescription holds a map of all types and enum values declared within a proto file.
 type FileDescription struct {
 	name  string
+	desc  protoreflect.FileDescriptor
 	types map[string]*TypeDescription
 	enums map[string]*EnumValueDescription
 }
@@ -68,6 +70,7 @@
 	}
 	return &FileDescription{
 		name:  fd.name,
+		desc:  fd.desc,
 		types: typesCopy,
 		enums: fd.enums,
 	}
@@ -78,6 +81,11 @@
 	return fd.name
 }
 
+// FileDescriptor returns the proto file descriptor associated with the file representation.
+func (fd *FileDescription) FileDescriptor() protoreflect.FileDescriptor {
+	return fd.desc
+}
+
 // GetEnumDescription returns an EnumDescription for a qualified enum value
 // name declared within the .proto file.
 func (fd *FileDescription) GetEnumDescription(enumName string) (*EnumValueDescription, bool) {
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/common/types/pb/pb.go /work/src/external-provisioner/vendor/github.com/google/cel-go/common/types/pb/pb.go
--- a/vendor/github.com/google/cel-go/common/types/pb/pb.go	2026-09-05 00:02:32.070804342 +0000
+++ b/vendor/github.com/google/cel-go/common/types/pb/pb.go	2026-09-05 00:03:03.438974618 +0000
@@ -42,6 +42,9 @@
 	files []*FileDescription
 	// extensions contains the mapping between a given type name, extension name and its FieldDescription
 	extensions map[string]map[string]*FieldDescription
+
+	// jsonFieldNames indicates whether json-style names are supported as proto field names.
+	jsonFieldNames bool
 }
 
 // extensionsMap is a type alias to a map[typeName]map[extensionName]*FieldDescription
@@ -81,13 +84,27 @@
 	return nil
 }
 
+// DbOption modifies feature flags enabled on the proto database.
+type DbOption func(*Db) *Db
+
+// JSONFieldNames configures the Db to support proto field accesses by their JSON names.
+func JSONFieldNames(enabled bool) DbOption {
+	return func(db *Db) *Db {
+		db.jsonFieldNames = enabled
+		return db
+	}
+}
+
 // NewDb creates a new `pb.Db` with an empty type name to file description map.
-func NewDb() *Db {
+func NewDb(opts ...DbOption) *Db {
 	pbdb := &Db{
 		revFileDescriptorMap: make(map[string]*FileDescription),
 		files:                []*FileDescription{},
 		extensions:           make(extensionMap),
 	}
+	for _, o := range opts {
+		pbdb = o(pbdb)
+	}
 	// The FileDescription objects in the default db contain lazily initialized TypeDescription
 	// values which may point to the state contained in the DefaultDb irrespective of this shallow
 	// copy; however, the type graph for a field is idempotently computed, and is guaranteed to
@@ -100,9 +117,15 @@
 	return pbdb
 }
 
+// JSONFieldNames indicates whether the database is configured for proto field accesses by JSON names.
+func (pbdb *Db) JSONFieldNames() bool {
+	return pbdb.jsonFieldNames
+}
+
 // Copy creates a copy of the current database with its own internal descriptor mapping.
 func (pbdb *Db) Copy() *Db {
 	copy := NewDb()
+	copy.jsonFieldNames = pbdb.jsonFieldNames
 	for _, fd := range pbdb.files {
 		hasFile := false
 		for _, fd2 := range copy.files {
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/common/types/pb/type.go /work/src/external-provisioner/vendor/github.com/google/cel-go/common/types/pb/type.go
--- a/vendor/github.com/google/cel-go/common/types/pb/type.go	2026-09-05 00:02:32.070804342 +0000
+++ b/vendor/github.com/google/cel-go/common/types/pb/type.go	2026-09-05 00:03:03.438974618 +0000
@@ -40,68 +40,92 @@
 
 // newTypeDescription produces a TypeDescription value for the fully-qualified proto type name
 // with a given descriptor.
-func newTypeDescription(typeName string, desc protoreflect.MessageDescriptor, extensions extensionMap) *TypeDescription {
+func newTypeDescription(typeName string, desc protoreflect.MessageDescriptor, pbdb *Db) *TypeDescription {
 	msgType := dynamicpb.NewMessageType(desc)
 	msgZero := dynamicpb.NewMessage(desc)
 	fieldMap := map[string]*FieldDescription{}
+	jsonFieldMap := map[string]*FieldDescription{}
 	fields := desc.Fields()
 	for i := 0; i < fields.Len(); i++ {
 		f := fields.Get(i)
-		fieldMap[string(f.Name())] = newFieldDescription(f)
+		fd := newFieldDescription(f, pbdb.jsonFieldNames)
+		fieldMap[fd.Name()] = fd
+		if pbdb.jsonFieldNames {
+			jsonFieldMap[fd.JSONName()] = fd
+		}
 	}
 	return &TypeDescription{
-		typeName:    typeName,
-		desc:        desc,
-		msgType:     msgType,
-		fieldMap:    fieldMap,
-		extensions:  extensions,
-		reflectType: reflectTypeOf(msgZero),
-		zeroMsg:     zeroValueOf(msgZero),
+		typeName:       typeName,
+		desc:           desc,
+		msgType:        msgType,
+		fieldMap:       fieldMap,
+		jsonFieldMap:   jsonFieldMap,
+		extensions:     pbdb.extensions,
+		reflectType:    reflectTypeOf(msgZero),
+		zeroMsg:        zeroValueOf(msgZero),
+		jsonFieldNames: pbdb.jsonFieldNames,
 	}
 }
 
 // TypeDescription is a collection of type metadata relevant to expression
 // checking and evaluation.
 type TypeDescription struct {
-	typeName    string
-	desc        protoreflect.MessageDescriptor
-	msgType     protoreflect.MessageType
-	fieldMap    map[string]*FieldDescription
-	extensions  extensionMap
-	reflectType reflect.Type
-	zeroMsg     proto.Message
+	typeName     string
+	desc         protoreflect.MessageDescriptor
+	msgType      protoreflect.MessageType
+	fieldMap     map[string]*FieldDescription
+	jsonFieldMap map[string]*FieldDescription
+	extensions   extensionMap
+	reflectType  reflect.Type
+	zeroMsg      proto.Message
+	// jsonFieldNames indicates if the type's fields are accessible via their JSON names.
+	jsonFieldNames bool
 }
 
 // Copy copies the type description with updated references to the Db.
 func (td *TypeDescription) Copy(pbdb *Db) *TypeDescription {
 	return &TypeDescription{
-		typeName:    td.typeName,
-		desc:        td.desc,
-		msgType:     td.msgType,
-		fieldMap:    td.fieldMap,
-		extensions:  pbdb.extensions,
-		reflectType: td.reflectType,
-		zeroMsg:     td.zeroMsg,
+		typeName:       td.typeName,
+		desc:           td.desc,
+		msgType:        td.msgType,
+		fieldMap:       td.fieldMap,
+		jsonFieldMap:   td.jsonFieldMap,
+		extensions:     pbdb.extensions,
+		reflectType:    td.reflectType,
+		zeroMsg:        td.zeroMsg,
+		jsonFieldNames: td.jsonFieldNames,
 	}
 }
 
 // FieldMap returns a string field name to FieldDescription map.
 func (td *TypeDescription) FieldMap() map[string]*FieldDescription {
+	if td.jsonFieldNames {
+		return td.jsonFieldMap
+	}
 	return td.fieldMap
 }
 
 // FieldByName returns (FieldDescription, true) if the field name is declared within the type.
 func (td *TypeDescription) FieldByName(name string) (*FieldDescription, bool) {
+	if td.jsonFieldNames {
+		fd, found := td.jsonFieldMap[name]
+		if found {
+			return fd, true
+		}
+	}
+
 	fd, found := td.fieldMap[name]
 	if found {
 		return fd, true
 	}
+
 	extFieldMap, found := td.extensions[td.typeName]
-	if !found {
-		return nil, false
+	if found {
+		fd, found = extFieldMap[name]
+		return fd, found
 	}
-	fd, found = extFieldMap[name]
-	return fd, found
+
+	return nil, false
 }
 
 // MaybeUnwrap accepts a proto message as input and unwraps it to a primitive CEL type if possible.
@@ -132,7 +156,7 @@
 }
 
 // newFieldDescription creates a new field description from a protoreflect.FieldDescriptor.
-func newFieldDescription(fieldDesc protoreflect.FieldDescriptor) *FieldDescription {
+func newFieldDescription(fieldDesc protoreflect.FieldDescriptor, jsonFieldNames bool) *FieldDescription {
 	var reflectType reflect.Type
 	var zeroMsg proto.Message
 	switch fieldDesc.Kind() {
@@ -168,15 +192,16 @@
 	}
 	var keyType, valType *FieldDescription
 	if fieldDesc.IsMap() {
-		keyType = newFieldDescription(fieldDesc.MapKey())
-		valType = newFieldDescription(fieldDesc.MapValue())
+		keyType = newFieldDescription(fieldDesc.MapKey(), jsonFieldNames)
+		valType = newFieldDescription(fieldDesc.MapValue(), jsonFieldNames)
 	}
 	return &FieldDescription{
-		desc:        fieldDesc,
-		KeyType:     keyType,
-		ValueType:   valType,
-		reflectType: reflectType,
-		zeroMsg:     zeroValueOf(zeroMsg),
+		desc:          fieldDesc,
+		KeyType:       keyType,
+		ValueType:     valType,
+		reflectType:   reflectType,
+		zeroMsg:       zeroValueOf(zeroMsg),
+		jsonFieldName: jsonFieldNames,
 	}
 }
 
@@ -187,9 +212,10 @@
 	// ValueType holds the value FieldDescription for map fields.
 	ValueType *FieldDescription
 
-	desc        protoreflect.FieldDescriptor
-	reflectType reflect.Type
-	zeroMsg     proto.Message
+	desc          protoreflect.FieldDescriptor
+	reflectType   reflect.Type
+	zeroMsg       proto.Message
+	jsonFieldName bool
 }
 
 // CheckedType returns the type-definition used at type-check time.
@@ -218,6 +244,14 @@
 	return fd.desc
 }
 
+// Documentation returns the documentation for the field.
+func (fd *FieldDescription) Documentation() string {
+	if parentFile := fd.desc.ParentFile(); parentFile != nil {
+		return parentFile.SourceLocations().ByDescriptor(fd.desc).LeadingComments
+	}
+	return ""
+}
+
 // IsSet returns whether the field is set on the target value, per the proto presence conventions
 // of proto2 or proto3 accordingly.
 //
@@ -321,11 +355,20 @@
 	return unwrapDynamic(fd, msg)
 }
 
-// Name returns the CamelCase name of the field within the proto-based struct.
+// Name returns the snake_case name of the field within the proto-based struct.
 func (fd *FieldDescription) Name() string {
 	return string(fd.desc.Name())
 }
 
+// JSONName returns the JSON name of the field, if present.
+func (fd *FieldDescription) JSONName() string {
+	jsonName := fd.desc.JSONName()
+	if len(jsonName) != 0 {
+		return jsonName
+	}
+	return string(fd.desc.Name())
+}
+
 // ProtoKind returns the protobuf reflected kind of the field.
 func (fd *FieldDescription) ProtoKind() protoreflect.Kind {
 	return fd.desc.Kind()
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/common/types/provider.go /work/src/external-provisioner/vendor/github.com/google/cel-go/common/types/provider.go
--- a/vendor/github.com/google/cel-go/common/types/provider.go	2026-09-05 00:02:32.070804342 +0000
+++ b/vendor/github.com/google/cel-go/common/types/provider.go	2026-09-05 00:03:03.434974597 +0000
@@ -81,6 +81,9 @@
 
 	// GetFrom retrieves the field value on the input object, if set.
 	GetFrom ref.FieldGetter
+
+	// IsJSONField
+	IsJSONField bool
 }
 
 // Registry provides type information for a set of registered types.
@@ -93,11 +96,40 @@
 // provider which can create new instances of the provided message or any
 // message that proto depends upon in its FileDescriptor.
 func NewRegistry(types ...proto.Message) (*Registry, error) {
-	p := &Registry{
+	return NewProtoRegistry(ProtoTypeDefs(types...))
+}
+
+// RegistryOption configures the behavior of the registry.
+type RegistryOption func(r *Registry) (*Registry, error)
+
+// JSONFieldNames configures JSON field name support within the protobuf types in the registry.
+func JSONFieldNames(enabled bool) RegistryOption {
+	return func(r *Registry) (*Registry, error) {
+		err := r.WithJSONFieldNames(enabled)
+		return r, err
+	}
+}
+
+// ProtoTypeDefs creates a RegistryOption which registers the individual proto messages with the registry.
+func ProtoTypeDefs(types ...proto.Message) RegistryOption {
+	return func(r *Registry) (*Registry, error) {
+		for _, msgType := range types {
+			err := r.RegisterMessage(msgType)
+			if err != nil {
+				return nil, err
+			}
+		}
+		return r, nil
+	}
+}
+
+// NewProtoRegistry creates a proto-based registry with a set of configurable options.
+func NewProtoRegistry(opts ...RegistryOption) (*Registry, error) {
+	r := &Registry{
 		revTypeMap: make(map[string]*Type),
 		pbdb:       pb.NewDb(),
 	}
-	err := p.RegisterType(
+	err := r.RegisterType(
 		BoolType,
 		BytesType,
 		DoubleType,
@@ -114,19 +146,19 @@
 		return nil, err
 	}
 	// This block ensures that the well-known protobuf types are registered by default.
-	for _, fd := range p.pbdb.FileDescriptions() {
-		err = p.registerAllTypes(fd)
+	for _, fd := range r.pbdb.FileDescriptions() {
+		err = r.registerAllTypes(fd)
 		if err != nil {
 			return nil, err
 		}
 	}
-	for _, msgType := range types {
-		err = p.RegisterMessage(msgType)
+	for _, opt := range opts {
+		r, err = opt(r)
 		if err != nil {
 			return nil, err
 		}
 	}
-	return p, nil
+	return r, nil
 }
 
 // NewEmptyRegistry returns a registry which is completely unconfigured.
@@ -149,6 +181,28 @@
 	return copy
 }
 
+// JSONFieldNames returns whether json field names are enabled in this registry.
+func (p *Registry) JSONFieldNames() bool {
+	return p.pbdb.JSONFieldNames()
+}
+
+// WithJSONFieldNames configures the registry with the JSON field name support enabled or disabled.
+func (p *Registry) WithJSONFieldNames(enabled bool) error {
+	if enabled == p.pbdb.JSONFieldNames() {
+		return nil
+	}
+	newDB := pb.NewDb(pb.JSONFieldNames(enabled))
+	files := p.pbdb.FileDescriptions()
+	for _, fd := range files {
+		_, err := newDB.RegisterDescriptor(fd.FileDescriptor())
+		if err != nil {
+			return err
+		}
+	}
+	p.pbdb = newDB
+	return nil
+}
+
 // EnumValue returns the numeric value of the given enum value name.
 func (p *Registry) EnumValue(enumName string) ref.Val {
 	enumVal, found := p.pbdb.DescribeEnum(enumName)
@@ -172,9 +226,11 @@
 		return nil, false
 	}
 	return &ref.FieldType{
-		Type:    field.CheckedType(),
-		IsSet:   field.IsSet,
-		GetFrom: field.GetFrom}, true
+		Type:        field.CheckedType(),
+		IsSet:       field.IsSet,
+		GetFrom:     field.GetFrom,
+		IsJSONField: p.pbdb.JSONFieldNames() && fieldName == field.JSONName(),
+	}, true
 }
 
 // FindStructFieldNames returns the set of field names for the given struct type,
@@ -206,9 +262,25 @@
 		return nil, false
 	}
 	return &FieldType{
-		Type:    fieldDescToCELType(field),
-		IsSet:   field.IsSet,
-		GetFrom: field.GetFrom}, true
+		Type:        fieldDescToCELType(field),
+		IsSet:       field.IsSet,
+		GetFrom:     field.GetFrom,
+		IsJSONField: p.pbdb.JSONFieldNames() && fieldName == field.JSONName(),
+	}, true
+}
+
+// FindStructFieldDescription returns documentation for a field if available.
+// Returns false if the field could not be found.
+func (p *Registry) FindStructFieldDescription(structType, fieldName string) (string, bool) {
+	msgType, found := p.pbdb.DescribeType(structType)
+	if !found {
+		return "", false
+	}
+	field, found := msgType.FieldByName(fieldName)
+	if !found {
+		return "", false
+	}
+	return field.Documentation(), true
 }
 
 // FindIdent takes a qualified identifier name and returns a ref.Val if one exists.
@@ -268,9 +340,8 @@
 		return NewErr("unknown type '%s'", structType)
 	}
 	msg := td.New()
-	fieldMap := td.FieldMap()
 	for name, value := range fields {
-		field, found := fieldMap[name]
+		field, found := td.FieldByName(name)
 		if !found {
 			return NewErr("no such field: %s", name)
 		}
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/common/types/ref/provider.go /work/src/external-provisioner/vendor/github.com/google/cel-go/common/types/ref/provider.go
--- a/vendor/github.com/google/cel-go/common/types/ref/provider.go	2026-09-05 00:02:32.070804342 +0000
+++ b/vendor/github.com/google/cel-go/common/types/ref/provider.go	2026-09-05 00:03:03.438974618 +0000
@@ -93,6 +93,9 @@
 
 	// GetFrom retrieves the field value on the input object, if set.
 	GetFrom FieldGetter
+
+	// IsJSONFIeld indicates that the field was accessed via its JSON name.
+	IsJSONField bool
 }
 
 // FieldTester is used to test field presence on an input object.
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/common/types/timestamp.go /work/src/external-provisioner/vendor/github.com/google/cel-go/common/types/timestamp.go
--- a/vendor/github.com/google/cel-go/common/types/timestamp.go	2026-09-05 00:02:32.070804342 +0000
+++ b/vendor/github.com/google/cel-go/common/types/timestamp.go	2026-09-05 00:03:03.434974597 +0000
@@ -302,6 +302,9 @@
 		if err != nil {
 			return WrapErr(err)
 		}
+		if min < 0 || min > 59 {
+			return WrapErr(fmt.Errorf("timezone offset minutes out of range [0, 59]: %s", val))
+		}
 		var offset int
 		if string(val[0]) == "-" {
 			offset = hr*60 - min
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/common/types/unknown.go /work/src/external-provisioner/vendor/github.com/google/cel-go/common/types/unknown.go
--- a/vendor/github.com/google/cel-go/common/types/unknown.go	2026-09-05 00:02:32.070804342 +0000
+++ b/vendor/github.com/google/cel-go/common/types/unknown.go	2026-09-05 00:03:03.434974597 +0000
@@ -181,6 +181,20 @@
 	return trails, found
 }
 
+// HasUnknownFunction returns whether any of the attribute trails contained within the unknown
+// are unspecified. Unspecified attributes typically indicate an unresolved function call
+// or operation, rather than a missing variable.
+func (u *Unknown) HasUnknownFunction() bool {
+	for _, trails := range u.attributeTrails {
+		for _, t := range trails {
+			if t.variable == "" {
+				return true
+			}
+		}
+	}
+	return false
+}
+
 // Contains returns true if the input unknown is a subset of the current unknown.
 func (u *Unknown) Contains(other *Unknown) bool {
 	for id, otherTrails := range other.attributeTrails {
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/ext/BUILD.bazel /work/src/external-provisioner/vendor/github.com/google/cel-go/ext/BUILD.bazel
--- a/vendor/github.com/google/cel-go/ext/BUILD.bazel	2026-09-05 00:02:32.070804342 +0000
+++ b/vendor/github.com/google/cel-go/ext/BUILD.bazel	2026-09-05 00:03:03.438974618 +0000
@@ -9,6 +9,7 @@
     srcs = [
         "bindings.go",
         "comprehensions.go",
+        "costs.go",
         "encoders.go",
         "extension_option_factory.go",
         "formatting.go",
@@ -17,6 +18,7 @@
         "lists.go",
         "math.go",
         "native.go",
+        "network.go",
         "protos.go",
         "regex.go",
         "sets.go",
@@ -39,6 +41,7 @@
         "//common/types/traits:go_default_library",
         "//interpreter:go_default_library",
         "//parser:go_default_library",
+        "@org_golang_google_protobuf//encoding/protojson:go_default_library",
         "@org_golang_google_protobuf//proto:go_default_library",
         "@org_golang_google_protobuf//reflect/protoreflect:go_default_library",
         "@org_golang_google_protobuf//types/known/structpb",
@@ -60,6 +63,7 @@
         "lists_test.go",
         "math_test.go",
         "native_test.go",
+        "network_test.go",
         "protos_test.go",
         "regex_test.go",
         "sets_test.go",
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/ext/README.md /work/src/external-provisioner/vendor/github.com/google/cel-go/ext/README.md
--- a/vendor/github.com/google/cel-go/ext/README.md	2026-09-05 00:02:32.070804342 +0000
+++ b/vendor/github.com/google/cel-go/ext/README.md	2026-09-05 00:03:03.438974618 +0000
@@ -55,6 +55,20 @@
 
     base64.encode(b'hello') // return 'aGVsbG8='
 
+### JSON.Encode
+
+Introduced at version: 1
+
+Encodes a CEL value to a JSON string.
+
+    json.encode(<dyn>) -> <string>
+
+Examples:
+
+    json.encode('hello')                      // return '"hello"'
+    json.encode([1, 'two', true])             // return '[1,"two",true]'
+    json.encode({'items': [1, 'two', false]}) // return '{"items":[1,"two",false]}'
+
 ## Math
 
 Math helper macros and functions.
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/ext/bindings.go /work/src/external-provisioner/vendor/github.com/google/cel-go/ext/bindings.go
--- a/vendor/github.com/google/cel-go/ext/bindings.go	2026-09-05 00:02:32.070804342 +0000
+++ b/vendor/github.com/google/cel-go/ext/bindings.go	2026-09-05 00:03:03.438974618 +0000
@@ -108,7 +108,7 @@
 
 func (lib *celBindings) ProgramOptions() []cel.ProgramOption {
 	if lib.version >= 1 {
-		celBlockPlan := func(i interpreter.Interpretable) (interpreter.Interpretable, error) {
+		celBlockPlan := func(i interpreter.InterpretableV2) (interpreter.InterpretableV2, error) {
 			call, ok := i.(interpreter.InterpretableCall)
 			if !ok {
 				return i, nil
@@ -140,7 +140,7 @@
 				return i, nil
 			}
 		}
-		return []cel.ProgramOption{cel.CustomDecorator(celBlockPlan)}
+		return []cel.ProgramOption{cel.CustomDecoratorV2(celBlockPlan)}
 	}
 	return []cel.ProgramOption{}
 }
@@ -190,7 +190,7 @@
 	), nil
 }
 
-func newDynamicBlock(slotExprs []interpreter.Interpretable, expr interpreter.Interpretable) interpreter.Interpretable {
+func newDynamicBlock(slotExprs []interpreter.InterpretableV2, expr interpreter.InterpretableV2) interpreter.InterpretableV2 {
 	bs := &dynamicBlock{
 		slotExprs: slotExprs,
 		expr:      expr,
@@ -213,8 +213,8 @@
 }
 
 type dynamicBlock struct {
-	slotExprs          []interpreter.Interpretable
-	expr               interpreter.Interpretable
+	slotExprs          []interpreter.InterpretableV2
+	expr               interpreter.InterpretableV2
 	slotActivationPool *sync.Pool
 }
 
@@ -223,12 +223,23 @@
 	return b.expr.ID()
 }
 
-// Eval implements the Interpretable interface method.
-func (b *dynamicBlock) Eval(activation cel.Activation) ref.Val {
+// Exec implements the Interpretable interface method and pushes a new frame onto the
+// execution frame for the duration of the block execution.
+func (b *dynamicBlock) Exec(frame *interpreter.ExecutionFrame) ref.Val {
 	sa := b.slotActivationPool.Get().(*dynamicSlotActivation)
-	sa.Activation = activation
+	sa.frame = frame.Push(sa)
+	// Ensure the 'unwrapped' Activation points to the original one from the frame,
+	// and not the hierarchical activation which composes the original and the slot
+	// activation.
+	sa.Activation = frame.Activation
+	defer sa.frame.Pop()
 	defer b.clearSlots(sa)
-	return b.expr.Eval(sa)
+	return b.expr.Exec(sa.frame)
+}
+
+// Eval implements the Interpretable interface method.
+func (b *dynamicBlock) Eval(activation cel.Activation) ref.Val {
+	return b.Exec(interpreter.AsFrame(activation))
 }
 
 func (b *dynamicBlock) clearSlots(sa *dynamicSlotActivation) {
@@ -243,7 +254,8 @@
 
 type dynamicSlotActivation struct {
 	cel.Activation
-	slotExprs []interpreter.Interpretable
+	frame     *interpreter.ExecutionFrame
+	slotExprs []interpreter.InterpretableV2
 	slotCount int
 	slotVals  []*slotVal
 }
@@ -267,7 +279,7 @@
 			return *v.value, true
 		}
 		v.visited = true
-		val := sa.slotExprs[idx].Eval(sa)
+		val := sa.slotExprs[idx].Exec(sa.frame)
 		v.value = &val
 		return val, true
 	}
@@ -276,13 +288,14 @@
 
 func (sa *dynamicSlotActivation) reset() {
 	sa.Activation = nil
+	sa.frame = nil
 	for _, sv := range sa.slotVals {
 		sv.visited = false
 		sv.value = nil
 	}
 }
 
-func newConstantBlock(slots traits.Lister, expr interpreter.Interpretable) interpreter.Interpretable {
+func newConstantBlock(slots traits.Lister, expr interpreter.InterpretableV2) interpreter.InterpretableV2 {
 	count := slots.Size().(types.Int)
 	return &constantBlock{slots: slots, slotCount: int(count), expr: expr}
 }
@@ -290,7 +303,7 @@
 type constantBlock struct {
 	slots     traits.Lister
 	slotCount int
-	expr      interpreter.Interpretable
+	expr      interpreter.InterpretableV2
 }
 
 // ID implements the interpreter.Interpretable interface method.
@@ -298,15 +311,24 @@
 	return b.expr.ID()
 }
 
+// Exec implements the Interpretable interface method and pushes a new frame onto the
+// stack for the duration of the block execution.
+func (b *constantBlock) Exec(frame *interpreter.ExecutionFrame) ref.Val {
+	sa := constantSlotActivation{Activation: frame.Activation, slots: b.slots, slotCount: b.slotCount}
+	sa.frame = frame.Push(sa)
+	defer sa.frame.Pop()
+	return b.expr.Exec(sa.frame)
+}
+
 // Eval implements the interpreter.Interpretable interface method, and will proxy @index prefixed variable
 // lookups into a set of constant slots determined from the plan step.
 func (b *constantBlock) Eval(activation cel.Activation) ref.Val {
-	vars := constantSlotActivation{Activation: activation, slots: b.slots, slotCount: b.slotCount}
-	return b.expr.Eval(vars)
+	return b.Exec(interpreter.AsFrame(activation))
 }
 
 type constantSlotActivation struct {
 	cel.Activation
+	frame     *interpreter.ExecutionFrame
 	slots     traits.Lister
 	slotCount int
 }
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/ext/costs.go /work/src/external-provisioner/vendor/github.com/google/cel-go/ext/costs.go
--- a/vendor/github.com/google/cel-go/ext/costs.go	1970-01-01 00:00:00.000000000 +0000
+++ b/vendor/github.com/google/cel-go/ext/costs.go	2026-09-05 00:03:03.438974618 +0000
@@ -0,0 +1,122 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package ext
+
+import (
+	"math"
+
+	"github.com/google/cel-go/checker"
+	"github.com/google/cel-go/common"
+	"github.com/google/cel-go/common/ast"
+	"github.com/google/cel-go/common/types"
+	"github.com/google/cel-go/common/types/ref"
+	"github.com/google/cel-go/common/types/traits"
+)
+
+var (
+	callCostEstimate = checker.FixedCostEstimate(1)
+	callCost         = uint64(1)
+	listAllocCost    = checker.FixedCostEstimate(common.ListCreateBaseCost)
+	stringCostFactor = common.StringTraversalCostFactor
+)
+
+func estimateStringScan(sz checker.SizeEstimate) (checker.CostEstimate, *checker.SizeEstimate) {
+	return estimateTraversal(sz, stringCostFactor, nil)
+}
+
+func estimateListAlloc(sz checker.SizeEstimate, costFactor float64) (checker.CostEstimate, *checker.SizeEstimate) {
+	return estimateTraversal(sz, costFactor, &listAllocCost)
+}
+
+// estimateTraversal computes cost as a function of the size of the target object and whether the call allocates memory.
+func estimateTraversal(nodeSize checker.SizeEstimate, costFactor float64, allocationCost *checker.CostEstimate) (checker.CostEstimate, *checker.SizeEstimate) {
+	cost := nodeSize.MultiplyByCostFactor(costFactor)
+	if allocationCost != nil {
+		cost = cost.Add(*allocationCost)
+	}
+	return cost, &nodeSize
+}
+
+func estimateSize(estimator checker.CostEstimator, node checker.AstNode) checker.SizeEstimate {
+	if l := node.ComputedSize(); l != nil {
+		return *l
+	}
+	if l := estimator.EstimateSize(node); l != nil {
+		return *l
+	}
+	return checker.SizeEstimate{Min: 0, Max: math.MaxUint64}
+}
+
+func actualSize(value ref.Val) uint64 {
+	if sz, ok := value.(traits.Sizer); ok {
+		return uint64(sz.Size().(types.Int))
+	}
+	return 1
+}
+
+func nodeAsUintValue(node checker.AstNode, defaultVal uint64) uint64 {
+	if node.Expr().Kind() != ast.LiteralKind {
+		return defaultVal
+	}
+	lit := node.Expr().AsLiteral()
+	if lit.Type() != types.IntType {
+		return defaultVal
+	}
+	val := lit.(types.Int)
+	if val < types.IntZero {
+		return 0
+	}
+	return uint64(lit.(types.Int))
+}
+
+func callEstimate(cost checker.CostEstimate, sz *checker.SizeEstimate) *checker.CallEstimate {
+	return &checker.CallEstimate{CostEstimate: cost, ResultSize: sz}
+}
+
+func rangedSizeEstimate(min, max uint64) checker.SizeEstimate {
+	return checker.SizeEstimate{Min: min, Max: max}
+}
+
+func fixedSizeEstimate(val uint64) checker.SizeEstimate {
+	return checker.FixedSizeEstimate(val)
+}
+
+func atLeastOne(size checker.SizeEstimate) checker.SizeEstimate {
+	if size.Min == 0 {
+		size.Min = 1
+	}
+	if size.Max == 0 {
+		size.Max = 1
+	}
+	return size
+}
+
+func safeAdd(x, y uint64, rest ...uint64) uint64 {
+	if y > 0 && x > math.MaxUint64-y {
+		return math.MaxUint64
+	}
+	next := x + y
+	if len(rest) == 0 {
+		return next
+	}
+	return safeAdd(next, rest[0], rest[1:]...)
+}
+
+func safeMul(x, y uint64) uint64 {
+	if y != 0 && x > math.MaxUint64/y {
+		return math.MaxUint64
+	}
+	return x * y
+}
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/ext/encoders.go /work/src/external-provisioner/vendor/github.com/google/cel-go/ext/encoders.go
--- a/vendor/github.com/google/cel-go/ext/encoders.go	2026-09-05 00:02:32.070804342 +0000
+++ b/vendor/github.com/google/cel-go/ext/encoders.go	2026-09-05 00:03:03.438974618 +0000
@@ -16,11 +16,14 @@
 
 import (
 	"encoding/base64"
+	"fmt"
 	"math"
 
 	"github.com/google/cel-go/cel"
 	"github.com/google/cel-go/common/types"
 	"github.com/google/cel-go/common/types/ref"
+	"google.golang.org/protobuf/encoding/protojson"
+	"google.golang.org/protobuf/types/known/structpb"
 )
 
 // Encoders returns a cel.EnvOption to configure extended functions for string, byte, and object
@@ -48,6 +51,18 @@
 // Examples:
 //
 //	base64.encode(b'hello') // return b'aGVsbG8='
+//
+// # JSON.Encode
+//
+// Introduced at version: 1
+//
+// Encodes a CEL value to a JSON string.
+//
+//	json.encode(<dyn>) -> <string>
+//
+// Examples:
+//
+//	json.encode({'hello': 'world'}) // return '{"hello":"world"}'
 func Encoders(options ...EncodersOption) cel.EnvOption {
 	l := &encoderLib{version: math.MaxUint32}
 	for _, o := range options {
@@ -75,8 +90,8 @@
 	return "cel.lib.ext.encoders"
 }
 
-func (*encoderLib) CompileOptions() []cel.EnvOption {
-	return []cel.EnvOption{
+func (lib *encoderLib) CompileOptions() []cel.EnvOption {
+	opts := []cel.EnvOption{
 		cel.Function("base64.decode",
 			cel.Overload("base64_decode_string", []*cel.Type{cel.StringType}, cel.BytesType,
 				cel.UnaryBinding(func(str ref.Val) ref.Val {
@@ -90,6 +105,16 @@
 					return stringOrError(base64EncodeBytes([]byte(b)))
 				}))),
 	}
+	if lib.version >= 1 {
+		opts = append(opts,
+			cel.Function("json.encode",
+				cel.Overload("json_encode_dyn", []*cel.Type{cel.DynType}, cel.StringType,
+					cel.UnaryBinding(func(val ref.Val) ref.Val {
+						return stringOrError(jsonEncodeValue(val))
+					}))),
+		)
+	}
+	return opts
 }
 
 func (*encoderLib) ProgramOptions() []cel.ProgramOption {
@@ -110,3 +135,19 @@
 func base64EncodeBytes(bytes []byte) (string, error) {
 	return base64.StdEncoding.EncodeToString(bytes), nil
 }
+
+func jsonEncodeValue(val ref.Val) (string, error) {
+	native, err := val.ConvertToNative(types.JSONValueType)
+	if err != nil {
+		return "", err
+	}
+	jsonValue, ok := native.(*structpb.Value)
+	if !ok {
+		return "", fmt.Errorf("cannot convert %T to JSON value", native)
+	}
+	jsonBytes, err := protojson.Marshal(jsonValue)
+	if err != nil {
+		return "", err
+	}
+	return string(jsonBytes), nil
+}
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/ext/formatting.go /work/src/external-provisioner/vendor/github.com/google/cel-go/ext/formatting.go
--- a/vendor/github.com/google/cel-go/ext/formatting.go	2026-09-05 00:02:32.070804342 +0000
+++ b/vendor/github.com/google/cel-go/ext/formatting.go	2026-09-05 00:03:03.438974618 +0000
@@ -410,7 +410,9 @@
 
 // stringFormatValidator implements the cel.ASTValidator interface allowing for static validation
 // of string.format calls.
-type stringFormatValidator struct{}
+type stringFormatValidator struct {
+	maxPrecision int
+}
 
 // Name returns the name of the validator.
 func (stringFormatValidator) Name() string {
@@ -427,7 +429,7 @@
 
 // Validate parses all literal format strings and type checks the format clause against the argument
 // at the corresponding ordinal within the list literal argument to the function, if one is specified.
-func (stringFormatValidator) Validate(env *cel.Env, _ cel.ValidatorConfig, a *ast.AST, iss *cel.Issues) {
+func (v stringFormatValidator) Validate(env *cel.Env, _ cel.ValidatorConfig, a *ast.AST, iss *cel.Issues) {
 	root := ast.NavigateAST(a)
 	formatCallExprs := ast.MatchDescendants(root, matchConstantFormatStringWithListLiteralArgs(a))
 	for _, e := range formatCallExprs {
@@ -439,7 +441,7 @@
 			ast:  a,
 		}
 		// use a placeholder locale, since locale doesn't affect syntax
-		_, err := parseFormatString(formatStr, formatCheck, formatCheck, "en_US")
+		_, err := parseFormatString(formatStr, formatCheck, formatCheck, "en_US", v.maxPrecision)
 		if err != nil {
 			iss.ReportErrorAtID(getErrorExprID(e.ID(), err), "%v", err)
 			continue
@@ -778,7 +780,7 @@
 
 // parseFormatString formats a string according to the string.format syntax, taking the clause implementations
 // from the provided FormatCallback and the args from the given FormatList.
-func parseFormatString(formatStr string, callback formatStringInterpolator, list formatListArgs, locale string) (string, error) {
+func parseFormatString(formatStr string, callback formatStringInterpolator, list formatListArgs, locale string, maxPrecision int) (string, error) {
 	i := 0
 	argIndex := 0
 	var builtStr strings.Builder
@@ -802,7 +804,7 @@
 				if int64(argIndex) >= list.Size() {
 					return "", fmt.Errorf("index %d out of range", argIndex)
 				}
-				numRead, val, refErr := parseAndFormatClause(formatStr[i:], argAny, callback, list, locale)
+				numRead, val, refErr := parseAndFormatClause(formatStr[i:], argAny, callback, list, locale, maxPrecision)
 				if refErr != nil {
 					return "", refErr
 				}
@@ -826,9 +828,9 @@
 
 // parseAndFormatClause parses the format clause at the start of the given string with val, and returns
 // how many characters were consumed and the substituted string form of val, or an error if one occurred.
-func parseAndFormatClause(formatStr string, val ref.Val, callback formatStringInterpolator, list formatListArgs, locale string) (int, string, error) {
+func parseAndFormatClause(formatStr string, val ref.Val, callback formatStringInterpolator, list formatListArgs, locale string, maxPrecision int) (int, string, error) {
 	i := 1
-	read, formatter, err := parseFormattingClause(formatStr[i:], callback)
+	read, formatter, err := parseFormattingClause(formatStr[i:], callback, maxPrecision)
 	i += read
 	if err != nil {
 		return -1, "", newParseFormatError("could not parse formatting clause", err)
@@ -841,9 +843,9 @@
 	return i, valStr, nil
 }
 
-func parseFormattingClause(formatStr string, callback formatStringInterpolator) (int, clauseImpl, error) {
+func parseFormattingClause(formatStr string, callback formatStringInterpolator, maxPrecision int) (int, clauseImpl, error) {
 	i := 0
-	read, precision, err := parsePrecision(formatStr[i:])
+	read, precision, err := parsePrecision(formatStr[i:], maxPrecision)
 	i += read
 	if err != nil {
 		return -1, nil, fmt.Errorf("error while parsing precision: %w", err)
@@ -870,7 +872,7 @@
 	}
 }
 
-func parsePrecision(formatStr string) (int, *int, error) {
+func parsePrecision(formatStr string, maxPrecision int) (int, *int, error) {
 	i := 0
 	if formatStr[i] != '.' {
 		return i, nil, nil
@@ -891,6 +893,9 @@
 	if err != nil {
 		return -1, nil, fmt.Errorf("error while converting precision to integer: %w", err)
 	}
+	if maxPrecision > 0 && precision > maxPrecision {
+		return -1, nil, fmt.Errorf("precision %d exceeds maximum allowed precision %d", precision, maxPrecision)
+	}
 	return i, &precision, nil
 }
 
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/ext/formatting_v2.go /work/src/external-provisioner/vendor/github.com/google/cel-go/ext/formatting_v2.go
--- a/vendor/github.com/google/cel-go/ext/formatting_v2.go	2026-09-05 00:02:32.070804342 +0000
+++ b/vendor/github.com/google/cel-go/ext/formatting_v2.go	2026-09-05 00:03:03.438974618 +0000
@@ -402,7 +402,9 @@
 
 // stringFormatValidatorV2 implements the cel.ASTValidator interface allowing for static validation
 // of string.format calls.
-type stringFormatValidatorV2 struct{}
+type stringFormatValidatorV2 struct {
+	maxPrecision int
+}
 
 // Name returns the name of the validator.
 func (stringFormatValidatorV2) Name() string {
@@ -419,7 +421,7 @@
 
 // Validate parses all literal format strings and type checks the format clause against the argument
 // at the corresponding ordinal within the list literal argument to the function, if one is specified.
-func (stringFormatValidatorV2) Validate(env *cel.Env, _ cel.ValidatorConfig, a *ast.AST, iss *cel.Issues) {
+func (v stringFormatValidatorV2) Validate(env *cel.Env, _ cel.ValidatorConfig, a *ast.AST, iss *cel.Issues) {
 	root := ast.NavigateAST(a)
 	formatCallExprs := ast.MatchDescendants(root, matchConstantFormatStringWithListLiteralArgs(a))
 	for _, e := range formatCallExprs {
@@ -431,7 +433,7 @@
 			ast:  a,
 		}
 		// use a placeholder locale, since locale doesn't affect syntax
-		_, err := parseFormatStringV2(formatStr, formatCheck, formatCheck)
+		_, err := parseFormatStringV2(formatStr, formatCheck, formatCheck, v.maxPrecision)
 		if err != nil {
 			iss.ReportErrorAtID(getErrorExprID(e.ID(), err), "%v", err)
 			continue
@@ -668,7 +670,7 @@
 
 // parseFormatString formats a string according to the string.format syntax, taking the clause implementations
 // from the provided FormatCallback and the args from the given FormatList.
-func parseFormatStringV2(formatStr string, callback formatStringInterpolatorV2, list formatListArgs) (string, error) {
+func parseFormatStringV2(formatStr string, callback formatStringInterpolatorV2, list formatListArgs, maxPrecision int) (string, error) {
 	i := 0
 	argIndex := 0
 	var builtStr strings.Builder
@@ -692,7 +694,7 @@
 				if int64(argIndex) >= list.Size() {
 					return "", fmt.Errorf("index %d out of range", argIndex)
 				}
-				numRead, val, refErr := parseAndFormatClauseV2(formatStr[i:], argAny, callback, list)
+				numRead, val, refErr := parseAndFormatClauseV2(formatStr[i:], argAny, callback, list, maxPrecision)
 				if refErr != nil {
 					return "", refErr
 				}
@@ -716,9 +718,9 @@
 
 // parseAndFormatClause parses the format clause at the start of the given string with val, and returns
 // how many characters were consumed and the substituted string form of val, or an error if one occurred.
-func parseAndFormatClauseV2(formatStr string, val ref.Val, callback formatStringInterpolatorV2, list formatListArgs) (int, string, error) {
+func parseAndFormatClauseV2(formatStr string, val ref.Val, callback formatStringInterpolatorV2, list formatListArgs, maxPrecision int) (int, string, error) {
 	i := 1
-	read, formatter, err := parseFormattingClauseV2(formatStr[i:], callback)
+	read, formatter, err := parseFormattingClauseV2(formatStr[i:], callback, maxPrecision)
 	i += read
 	if err != nil {
 		return -1, "", newParseFormatError("could not parse formatting clause", err)
@@ -731,9 +733,9 @@
 	return i, valStr, nil
 }
 
-func parseFormattingClauseV2(formatStr string, callback formatStringInterpolatorV2) (int, clauseImplV2, error) {
+func parseFormattingClauseV2(formatStr string, callback formatStringInterpolatorV2, maxPrecision int) (int, clauseImplV2, error) {
 	i := 0
-	read, precision, err := parsePrecisionV2(formatStr[i:])
+	read, precision, err := parsePrecisionV2(formatStr[i:], maxPrecision)
 	i += read
 	if err != nil {
 		return -1, nil, fmt.Errorf("error while parsing precision: %w", err)
@@ -760,7 +762,7 @@
 	}
 }
 
-func parsePrecisionV2(formatStr string) (int, int, error) {
+func parsePrecisionV2(formatStr string, maxPrecision int) (int, int, error) {
 	i := 0
 	if formatStr[i] != '.' {
 		return i, defaultPrecision, nil
@@ -784,5 +786,8 @@
 	if precision < 0 {
 		return -1, -1, fmt.Errorf("negative precision: %d", precision)
 	}
+	if maxPrecision > 0 && precision > maxPrecision {
+		return -1, -1, fmt.Errorf("precision %d exceeds maximum allowed precision %d", precision, maxPrecision)
+	}
 	return i, precision, nil
 }
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/ext/lists.go /work/src/external-provisioner/vendor/github.com/google/cel-go/ext/lists.go
--- a/vendor/github.com/google/cel-go/ext/lists.go	2026-09-05 00:02:32.070804342 +0000
+++ b/vendor/github.com/google/cel-go/ext/lists.go	2026-09-05 00:03:03.438974618 +0000
@@ -153,15 +153,18 @@
 //	].sortBy(e, e.score).map(e, e.name)
 //	== ["bar", "foo", "baz"]
 func Lists(options ...ListsOption) cel.EnvOption {
-	l := &listsLib{version: math.MaxUint32}
+	l := &listsLib{version: math.MaxUint32, maxRangeSize: defaultMaxRangeSize}
 	for _, o := range options {
 		l = o(l)
 	}
 	return cel.Lib(l)
 }
 
+const defaultMaxRangeSize = 1_000_000
+
 type listsLib struct {
-	version uint32
+	version      uint32
+	maxRangeSize int64
 }
 
 // LibraryName implements the SingletonLibrary interface method.
@@ -188,6 +191,16 @@
 	}
 }
 
+// ListsMaxRangeSize sets the maximum number of elements lists.range() will
+// allocate. If not set, the default is 10,000,000. Setting this to zero
+// disables the limit (not recommended).
+func ListsMaxRangeSize(size int64) ListsOption {
+	return func(lib *listsLib) *listsLib {
+		lib.maxRangeSize = size
+		return lib
+	}
+}
+
 // CompileOptions implements the Library interface method.
 func (lib listsLib) CompileOptions() []cel.EnvOption {
 	listType := cel.ListType(cel.TypeParamType("T"))
@@ -309,11 +322,12 @@
 			)...,
 		))
 
+		maxRange := lib.maxRangeSize
 		opts = append(opts, cel.Function("lists.range",
 			cel.Overload("lists_range",
 				[]*cel.Type{cel.IntType}, cel.ListType(cel.IntType),
 				cel.UnaryBinding(func(n ref.Val) ref.Val {
-					result, err := genRange(n.(types.Int))
+					result, err := genRange(n.(types.Int), maxRange)
 					if err != nil {
 						return types.WrapErr(err)
 					}
@@ -403,8 +417,14 @@
 	return opts
 }
 
-func genRange(n types.Int) (ref.Val, error) {
-	var newList []ref.Val
+func genRange(n types.Int, maxSize int64) (ref.Val, error) {
+	if n < 0 {
+		return nil, fmt.Errorf("lists.range: size must be non-negative, got %d", n)
+	}
+	if maxSize > 0 && int64(n) > maxSize {
+		return nil, fmt.Errorf("lists.range: size %d exceeds maximum allowed (%d)", n, maxSize)
+	}
+	newList := make([]ref.Val, 0, n)
 	for i := types.Int(0); i < n; i++ {
 		newList = append(newList, i)
 	}
@@ -616,8 +636,8 @@
 		return nil
 	}
 	sz := estimateSize(estimator, *target)
-	start := nodeAsIntValue(args[0], 0)
-	end := nodeAsIntValue(args[1], sz.Max)
+	start := nodeAsUintValue(args[0], 0)
+	end := nodeAsUintValue(args[1], sz.Max)
 	return estimateAllocatingListCall(1, checker.FixedSizeEstimate(end-start))
 }
 
@@ -626,7 +646,7 @@
 	if target != nil || len(args) != 1 {
 		return nil
 	}
-	return estimateAllocatingListCall(1, checker.FixedSizeEstimate(nodeAsIntValue(args[0], math.MaxUint)))
+	return estimateAllocatingListCall(1, checker.FixedSizeEstimate(nodeAsUintValue(args[0], math.MaxUint)))
 }
 
 // estimateListReverse computes an O(n) reverse operation with a cost factor of 1.
@@ -644,7 +664,7 @@
 	}
 	depth := uint64(1)
 	if len(args) == 1 {
-		depth = nodeAsIntValue(args[0], math.MaxUint)
+		depth = nodeAsUintValue(args[0], math.MaxUint)
 	}
 	return estimateAllocatingListCall(float64(depth), estimateSize(estimator, *target))
 }
@@ -753,27 +773,12 @@
 	if elem.Type() == types.StringType || elem.Type() == types.BytesType {
 		costFactor += common.StringTraversalCostFactor
 	}
-	return trackAllocatingListCall(costFactor, sz*sz)
+	return trackAllocatingListCall(costFactor, safeMul(sz, sz))
 }
 
 // trackAllocatingListCall computes costs as a function of the size of the result list with a baseline cost
 // for the call dispatch and the associated list allocation.
 func trackAllocatingListCall(costFactor float64, size uint64) *uint64 {
-	cost := uint64(float64(size)*costFactor) + callCost + common.ListCreateBaseCost
+	cost := safeAdd(uint64(float64(size)*costFactor), callCost, common.ListCreateBaseCost)
 	return &cost
 }
-
-func nodeAsIntValue(node checker.AstNode, defaultVal uint64) uint64 {
-	if node.Expr().Kind() != ast.LiteralKind {
-		return defaultVal
-	}
-	lit := node.Expr().AsLiteral()
-	if lit.Type() != types.IntType {
-		return defaultVal
-	}
-	val := lit.(types.Int)
-	if val < types.IntZero {
-		return 0
-	}
-	return uint64(lit.(types.Int))
-}
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/ext/native.go /work/src/external-provisioner/vendor/github.com/google/cel-go/ext/native.go
--- a/vendor/github.com/google/cel-go/ext/native.go	2026-09-05 00:02:32.074804362 +0000
+++ b/vendor/github.com/google/cel-go/ext/native.go	2026-09-05 00:03:03.438974618 +0000
@@ -434,10 +434,18 @@
 		if refType == timestampType {
 			return cel.TimestampType, true
 		}
+		if refType.Implements(refValType) {
+			emptyCelVal := reflect.New(refType).Elem().Interface().(ref.Val)
+			return emptyCelVal.Type().(*cel.Type), true
+		}
 		return cel.ObjectType(
 			fmt.Sprintf("%s.%s", simplePkgAlias(refType.PkgPath()), refType.Name()),
 		), true
 	case reflect.Pointer:
+		if refType.Implements(refValType) {
+			emptyCelVal := reflect.New(refType.Elem()).Interface().(ref.Val)
+			return emptyCelVal.Type().(*cel.Type), true
+		}
 		if refType.Implements(pbMsgInterfaceType) {
 			pbMsg := reflect.New(refType.Elem()).Interface().(protoreflect.ProtoMessage)
 			return cel.ObjectType(string(pbMsg.ProtoReflect().Descriptor().FullName())), true
@@ -608,6 +616,10 @@
 	alreadySeen := make(map[string]struct{})
 	var iterateStructMembers func(reflect.Type)
 	iterateStructMembers = func(t reflect.Type) {
+		if t.Implements(reflect.TypeFor[ref.Val]()) {
+			// skip this field since it's a CEL ref.Val instance.
+			return
+		}
 		if k := t.Kind(); k == reflect.Pointer || k == reflect.Slice || k == reflect.Array || k == reflect.Map {
 			iterateStructMembers(t.Elem())
 			return
@@ -791,7 +803,8 @@
 }
 
 var (
-	pbMsgInterfaceType = reflect.TypeOf((*protoreflect.ProtoMessage)(nil)).Elem()
-	timestampType      = reflect.TypeOf(time.Now())
-	durationType       = reflect.TypeOf(time.Nanosecond)
+	pbMsgInterfaceType = reflect.TypeFor[protoreflect.ProtoMessage]()
+	refValType         = reflect.TypeFor[ref.Val]()
+	timestampType      = reflect.TypeFor[time.Time]()
+	durationType       = reflect.TypeFor[time.Duration]()
 )
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/ext/network.go /work/src/external-provisioner/vendor/github.com/google/cel-go/ext/network.go
--- a/vendor/github.com/google/cel-go/ext/network.go	1970-01-01 00:00:00.000000000 +0000
+++ b/vendor/github.com/google/cel-go/ext/network.go	2026-09-05 00:03:03.438974618 +0000
@@ -0,0 +1,619 @@
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package ext
+
+import (
+	"fmt"
+	"net/netip"
+	"reflect"
+
+	"github.com/google/cel-go/cel"
+	"github.com/google/cel-go/common/ast"
+	"github.com/google/cel-go/common/types"
+	"github.com/google/cel-go/common/types/ref"
+)
+
+const (
+	// Version1 is the initial version of the Network library, providing
+	// parity with Kubernetes v1.30+ CEL network functions.
+	Version1 uint32 = 1
+)
+
+// Network returns a cel.EnvOption to configure extended functions for network
+// address parsing, inspection, and CIDR range manipulation.
+//
+// Note: This library defines global functions `ip`, `cidr`, `isIP`, `isCIDR`
+// and `ip.isCanonical`. If you are currently using variables named `ip` or
+// `cidr`, these functions will likely work as intended, however there is a
+// chance for collision.
+//
+// The library closely mirrors the behavior of the Kubernetes CEL network
+// libraries, treating IP addresses and CIDR ranges as opaque types. It parses
+// IPs strictly: IPv4-mapped IPv6 addresses and IP zones are not allowed.
+//
+// This library includes a TypeAdapter that allows `netip.Addr` and
+// `netip.Prefix` Go types to be passed directly into the CEL environment.
+//
+// # IP Addresses
+//
+// The `ip` function converts a string to an IP address (IPv4 or IPv6). If the
+// string is not a valid IP, an error is returned. The `isIP` function checks
+// if a string is a valid IP address without throwing an error.
+//
+//	ip(string) -> ip
+//	isIP(string) -> bool
+//
+// Examples:
+//
+//	ip('127.0.0.1')
+//	ip('::1')
+//	isIP('1.2.3.4') // true
+//	isIP('invalid') // false
+//
+// # CIDR Ranges
+//
+// The `cidr` function converts a string to a Classless Inter-Domain Routing
+// (CIDR) range. If the string is not valid, an error is returned.
+//
+// The `isCIDR` function checks if a string is a valid CIDR notation. Note that
+// `isCIDR` allows CIDR values with or without host bits (e.g., '10.0.0.1/8'
+// or '10.0.0.0/8').
+//
+//	cidr(string) -> cidr
+//	isCIDR(string) -> bool
+//
+// Examples:
+//
+//	cidr('192.168.0.0/24')
+//	cidr('::1/128')
+//	isCIDR('10.0.0.0/8') // true
+//	isCIDR('10.0.0.1/8') // true
+//
+// # IP Inspection and Canonicalization
+//
+// IP objects support various inspection methods.
+//
+//	<ip>.family() -> int
+//	<ip>.isLoopback() -> bool
+//	<ip>.isGlobalUnicast() -> bool
+//	<ip>.isLinkLocalMulticast() -> bool
+//	<ip>.isLinkLocalUnicast() -> bool
+//	<ip>.isUnspecified() -> bool
+//
+// The `ip.isCanonical` function takes a string and returns true if it matches
+// the RFC 5952 canonical string representation of that address.
+//
+//	ip.isCanonical(string) -> bool
+//
+// Examples:
+//
+//	ip('127.0.0.1').family() == 4
+//	ip('::1').family() == 6
+//	ip('127.0.0.1').isLoopback() == true
+//	ip.isCanonical('2001:db8::1') == true  // RFC 5952 format
+//	ip.isCanonical('2001:DB8::1') == false // Uppercase is not canonical
+//	ip.isCanonical('2001:db8:0:0:0:0:0:1') == false // Expanded is not canonical
+//
+// # CIDR Member Functions
+//
+// CIDR objects support containment checks and property extraction.
+//
+//	<cidr>.containsIP(ip|string) -> bool
+//	<cidr>.containsCIDR(cidr|string) -> bool
+//	<cidr>.ip() -> ip
+//	<cidr>.isMask() -> bool
+//	<cidr>.masked() -> cidr
+//	<cidr>.prefixLength() -> int
+//
+// Examples:
+//
+//	cidr('10.0.0.0/8').containsIP(ip('10.0.0.1')) == true
+//	cidr('10.0.0.0/8').containsIP('10.0.0.1') == true
+//	cidr('10.0.0.0/8').containsCIDR('10.1.0.0/16') == true
+//	cidr('192.168.1.5/24').ip() == ip('192.168.1.5')
+//	cidr('192.168.1.0/24').isMask() == true
+//	cidr('192.168.1.5/24').isMask() == false
+//	cidr('192.168.1.5/24').masked() == cidr('192.168.1.0/24')
+//	cidr('192.168.1.0/24').prefixLength() == 24
+func Network(opts ...NetworkOption) cel.EnvOption {
+	lib := &networkLib{version: Version1}
+	for _, o := range opts {
+		lib = o(lib)
+	}
+	return func(e *cel.Env) (*cel.Env, error) {
+		// Install the library (Types and Functions)
+		e, err := cel.Lib(lib)(e)
+		if err != nil {
+			return nil, err
+		}
+
+		// Install the Adapter (Wrapping the existing one)
+		adapter := &networkAdapter{Adapter: e.CELTypeAdapter()}
+		return cel.CustomTypeAdapter(adapter)(e)
+	}
+}
+
+// NetworkOption declares a functional operator for configuring the Network library behavior.
+type NetworkOption func(*networkLib) *networkLib
+
+// NetworkVersion sets the version of the network library to an explicit version.
+func NetworkVersion(version uint32) NetworkOption {
+	return func(lib *networkLib) *networkLib {
+		lib.version = version
+		return lib
+	}
+}
+
+const (
+	// Function names matching the original Kubernetes implementation of this networking library.
+	// isStrictCIDR and isInterfaceAddress are added to enable strict isCIDR parsing without breaking
+	// functionality for existing users. Ctx: https://github.com/kubernetes/kubernetes/issues/134224
+	cidrFunc             = "cidr"
+	cidrToString         = "string"
+	containsCIDRFunc     = "containsCIDR"
+	containsIPFunc       = "containsIP"
+	familyFunc           = "family"
+	ipFunc               = "ip"
+	ipToString           = "string"
+	isCanonicalFunc      = "ip.isCanonical"
+	isCIDRFunc           = "isCIDR"
+	isGlobalUnicastFunc  = "isGlobalUnicast"
+	isIPFunc             = "isIP"
+	isLinkLocalMcastFunc = "isLinkLocalMulticast"
+	isLinkLocalUcastFunc = "isLinkLocalUnicast"
+	isLoopbackFunc       = "isLoopback"
+	isMaskFunc           = "isMask"
+	isUnspecifiedFunc    = "isUnspecified"
+	maskedFunc           = "masked"
+	prefixLengthFunc     = "prefixLength"
+)
+
+var (
+	// Definitions for the Opaque Types
+	IPType   = types.NewOpaqueType("net.IP")
+	CIDRType = types.NewOpaqueType("net.CIDR")
+)
+
+type networkLib struct {
+	version uint32
+}
+
+func (*networkLib) LibraryName() string {
+	return "cel.lib.ext.network"
+}
+
+func (*networkLib) CompileOptions() []cel.EnvOption {
+	return []cel.EnvOption{
+		// 1. Register Types
+		cel.Types(
+			IPType,
+			CIDRType,
+		),
+
+		// 2. Register Functions
+		cel.Function(cidrFunc,
+			// K8s Parity: Following the pattern, this is "string_to_cidr"
+			cel.Overload("string_to_cidr", []*cel.Type{cel.StringType}, CIDRType,
+				cel.UnaryBinding(netCIDRString)),
+		),
+		cel.Function(cidrToString,
+			cel.Overload("cidr_to_string", []*cel.Type{CIDRType}, cel.StringType,
+				cel.UnaryBinding(netCIDRToString)),
+		),
+		cel.Function(containsCIDRFunc,
+			cel.MemberOverload("cidr_contains_cidr", []*cel.Type{CIDRType, CIDRType}, cel.BoolType,
+				cel.BinaryBinding(netCIDRContainsCIDR)),
+			cel.MemberOverload("cidr_contains_cidr_string", []*cel.Type{CIDRType, cel.StringType}, cel.BoolType,
+				cel.BinaryBinding(netCIDRContainsCIDRString)),
+		),
+		cel.Function(containsIPFunc,
+			cel.MemberOverload("cidr_contains_ip_ip", []*cel.Type{CIDRType, IPType}, cel.BoolType,
+				cel.BinaryBinding(netCIDRContainsIP)),
+			cel.MemberOverload("cidr_contains_ip_string", []*cel.Type{CIDRType, cel.StringType}, cel.BoolType,
+				cel.BinaryBinding(netCIDRContainsIPString)),
+		),
+		cel.Function(familyFunc,
+			cel.MemberOverload("ip_family", []*cel.Type{IPType}, cel.IntType,
+				cel.UnaryBinding(netIPFamily)),
+		),
+		cel.Function(ipFunc,
+			// K8s Parity: The global overload is named "string_to_ip"
+			cel.Overload("string_to_ip", []*cel.Type{cel.StringType}, IPType,
+				cel.UnaryBinding(netIPString)),
+			// K8s Parity: The member overload is named "cidr_ip"
+			cel.MemberOverload("cidr_ip", []*cel.Type{CIDRType}, IPType,
+				cel.UnaryBinding(netCIDRIP)),
+		),
+		cel.Function(ipToString,
+			cel.Overload("ip_to_string", []*cel.Type{IPType}, cel.StringType,
+				cel.UnaryBinding(netIPToString)),
+		),
+		cel.Function(isCanonicalFunc,
+			cel.Overload("ip_is_canonical", []*cel.Type{cel.StringType}, cel.BoolType,
+				cel.UnaryBinding(netIPIsCanonical)),
+		),
+		cel.Function(isCIDRFunc,
+			cel.Overload("is_cidr", []*cel.Type{cel.StringType}, cel.BoolType,
+				cel.UnaryBinding(netIsCIDR)),
+		),
+		cel.Function(isGlobalUnicastFunc,
+			cel.MemberOverload("ip_is_global_unicast", []*cel.Type{IPType}, cel.BoolType,
+				cel.UnaryBinding(netIPIsGlobalUnicast)),
+		),
+		cel.Function(isIPFunc,
+			cel.Overload("is_ip", []*cel.Type{cel.StringType}, cel.BoolType,
+				cel.UnaryBinding(netIsIP)),
+		),
+		cel.Function(isLinkLocalMcastFunc,
+			cel.MemberOverload("ip_is_link_local_multicast", []*cel.Type{IPType}, cel.BoolType,
+				cel.UnaryBinding(netIPIsLinkLocalMulticast)),
+		),
+		cel.Function(isLinkLocalUcastFunc,
+			cel.MemberOverload("ip_is_link_local_unicast", []*cel.Type{IPType}, cel.BoolType,
+				cel.UnaryBinding(netIPIsLinkLocalUnicast)),
+		),
+		cel.Function(isLoopbackFunc,
+			cel.MemberOverload("ip_is_loopback", []*cel.Type{IPType}, cel.BoolType,
+				cel.UnaryBinding(netIPIsLoopback)),
+		),
+		cel.Function(isMaskFunc,
+			cel.MemberOverload("cidr_is_mask", []*cel.Type{CIDRType}, cel.BoolType,
+				cel.UnaryBinding(netCIDRIsMask)),
+		),
+		cel.Function(isUnspecifiedFunc,
+			cel.MemberOverload("ip_is_unspecified", []*cel.Type{IPType}, cel.BoolType,
+				cel.UnaryBinding(netIPIsUnspecified)),
+		),
+		cel.Function(maskedFunc,
+			cel.MemberOverload("cidr_masked", []*cel.Type{CIDRType}, CIDRType,
+				cel.UnaryBinding(netCIDRMasked)),
+		),
+		cel.Function(prefixLengthFunc,
+			cel.MemberOverload("cidr_prefix_length", []*cel.Type{CIDRType}, cel.IntType,
+				cel.UnaryBinding(netCIDRPrefixLength)),
+		),
+		cel.ASTValidators(
+			networkFormatValidator{funcName: ipFunc, argNum: 0, check: checkIP},
+			networkFormatValidator{funcName: cidrFunc, argNum: 0, check: checkCIDR},
+		),
+	}
+}
+
+func (*networkLib) ProgramOptions() []cel.ProgramOption {
+	return []cel.ProgramOption{}
+}
+
+// networkAdapter adapts netip types while preserving existing adapters.
+type networkAdapter struct {
+	types.Adapter
+}
+
+func (a *networkAdapter) NativeToValue(value any) ref.Val {
+	switch v := value.(type) {
+	case netip.Addr:
+		return IP{Addr: v}
+	case netip.Prefix:
+		return CIDR{Prefix: v}
+	}
+	// Delegate to the wrapped adapter (e.g., Protobuf adapter)
+	return a.Adapter.NativeToValue(value)
+}
+
+// --- Implementation Logic ---
+
+func netCIDRContainsCIDR(lhs, rhs ref.Val) ref.Val {
+	parent := lhs.(CIDR)
+	child := rhs.(CIDR)
+	return types.Bool(parent.Prefix.Overlaps(child.Prefix) && parent.Prefix.Bits() <= child.Prefix.Bits())
+}
+
+func netCIDRContainsCIDRString(lhs, rhs ref.Val) ref.Val {
+	parent := lhs.(CIDR)
+	s := rhs.(types.String)
+	childPrefix, err := parseCIDR(string(s))
+	if err != nil {
+		return types.WrapErr(err)
+	}
+	return types.Bool(parent.Prefix.Overlaps(childPrefix) && parent.Prefix.Bits() <= childPrefix.Bits())
+}
+
+func netCIDRContainsIP(lhs, rhs ref.Val) ref.Val {
+	cidr := lhs.(CIDR)
+	ip := rhs.(IP)
+	return types.Bool(cidr.Prefix.Contains(ip.Addr))
+}
+
+func netCIDRContainsIPString(lhs, rhs ref.Val) ref.Val {
+	cidr := lhs.(CIDR)
+	s := rhs.(types.String)
+	addr, err := parseIPAddr(string(s))
+	if err != nil {
+		return types.WrapErr(err)
+	}
+	return types.Bool(cidr.Prefix.Contains(addr))
+}
+
+func netCIDRIP(val ref.Val) ref.Val {
+	cidr := val.(CIDR)
+	return IP{Addr: cidr.Prefix.Addr()}
+}
+
+func netCIDRMasked(val ref.Val) ref.Val {
+	cidr := val.(CIDR)
+	return CIDR{Prefix: cidr.Prefix.Masked()}
+}
+
+func netCIDRPrefixLength(val ref.Val) ref.Val {
+	cidr := val.(CIDR)
+	return types.Int(cidr.Prefix.Bits())
+}
+
+func netCIDRString(val ref.Val) ref.Val {
+	s := val.(types.String)
+	str := string(s)
+	prefix, err := parseCIDR(str)
+	if err != nil {
+		return types.WrapErr(err)
+	}
+	return CIDR{Prefix: prefix}
+}
+
+func netCIDRToString(val ref.Val) ref.Val {
+	cidr := val.(CIDR)
+	return types.String(cidr.Prefix.String())
+}
+
+func netIPFamily(val ref.Val) ref.Val {
+	ip := val.(IP)
+	if ip.Addr.Is4() {
+		return types.Int(4)
+	}
+	return types.Int(6)
+}
+
+func netIPIsCanonical(val ref.Val) ref.Val {
+	s := val.(types.String)
+	str := string(s)
+	addr, err := parseIPAddr(str)
+	if err != nil {
+		return types.WrapErr(err)
+	}
+	return types.Bool(addr.String() == str)
+}
+
+func netIPIsGlobalUnicast(val ref.Val) ref.Val {
+	ip := val.(IP)
+	return types.Bool(ip.Addr.IsGlobalUnicast())
+}
+
+func netIPIsLinkLocalMulticast(val ref.Val) ref.Val {
+	ip := val.(IP)
+	return types.Bool(ip.Addr.IsLinkLocalMulticast())
+}
+
+func netIPIsLinkLocalUnicast(val ref.Val) ref.Val {
+	ip := val.(IP)
+	return types.Bool(ip.Addr.IsLinkLocalUnicast())
+}
+
+func netIPIsLoopback(val ref.Val) ref.Val {
+	ip := val.(IP)
+	return types.Bool(ip.Addr.IsLoopback())
+}
+
+func netIPIsUnspecified(val ref.Val) ref.Val {
+	ip := val.(IP)
+	return types.Bool(ip.Addr.IsUnspecified())
+}
+
+func netIPString(val ref.Val) ref.Val {
+	s := val.(types.String)
+	str := string(s)
+	addr, err := parseIPAddr(str)
+	if err != nil {
+		return types.WrapErr(err)
+	}
+	return IP{Addr: addr}
+}
+
+func netIPToString(val ref.Val) ref.Val {
+	ip := val.(IP)
+	return types.String(ip.Addr.String())
+}
+
+func netIsCIDR(val ref.Val) ref.Val {
+	s := val.(types.String)
+	_, err := parseCIDR(string(s))
+	return types.Bool(err == nil)
+}
+
+func netIsIP(val ref.Val) ref.Val {
+	s := val.(types.String)
+	_, err := parseIPAddr(string(s))
+	return types.Bool(err == nil)
+}
+
+func netCIDRIsMask(val ref.Val) ref.Val {
+	cidr := val.(CIDR)
+	return types.Bool(cidr.Prefix.Addr() == cidr.Prefix.Masked().Addr())
+}
+
+func parseCIDR(raw string) (netip.Prefix, error) {
+	prefix, err := netip.ParsePrefix(raw)
+	if err != nil {
+		return netip.Prefix{}, fmt.Errorf("CIDR %q parse error during conversion from string: %v", raw, err)
+	}
+	if prefix.Addr().Zone() != "" {
+		return netip.Prefix{}, fmt.Errorf("CIDR %q with zone value is not allowed", raw)
+	}
+	if prefix.Addr().Is4In6() {
+		return netip.Prefix{}, fmt.Errorf("IPv4-mapped IPv6 address %q is not allowed", raw)
+	}
+	return prefix, nil
+}
+
+func parseIPAddr(raw string) (netip.Addr, error) {
+	addr, err := netip.ParseAddr(raw)
+	if err != nil {
+		return netip.Addr{}, fmt.Errorf("IP Address %q parse error during conversion from string: %v", raw, err)
+	}
+	if addr.Zone() != "" {
+		return netip.Addr{}, fmt.Errorf("IP address %q with zone value is not allowed", raw)
+	}
+	if addr.Is4In6() {
+		return netip.Addr{}, fmt.Errorf("IPv4-mapped IPv6 address %q is not allowed", raw)
+	}
+	return addr, nil
+}
+
+// --- Opaque Type Wrappers ---
+
+type IP struct {
+	netip.Addr
+}
+
+// ConvertToNative converts the IP value to a native Go type.
+func (i IP) ConvertToNative(typeDesc reflect.Type) (any, error) {
+	if typeDesc == reflect.TypeFor[netip.Addr]() {
+		return i.Addr, nil
+	}
+	if typeDesc.Kind() == reflect.String {
+		return i.Addr.String(), nil
+	}
+	return nil, fmt.Errorf("unsupported type conversion to '%v'", typeDesc)
+}
+
+// ConvertToType converts the IP value to a CEL type.
+func (i IP) ConvertToType(typeValue ref.Type) ref.Val {
+	switch typeValue {
+	case types.StringType:
+		return types.String(i.Addr.String())
+	case IPType:
+		return i
+	case types.TypeType:
+		return IPType
+	}
+	return types.NewErr("type conversion error from '%s' to '%s'", IPType, typeValue)
+}
+
+// Equal returns true if this IP is equal to the other ref.Val.
+func (i IP) Equal(other ref.Val) ref.Val {
+	o, ok := other.(IP)
+	if !ok {
+		return types.False
+	}
+	return types.Bool(i.Addr == o.Addr)
+}
+
+// Type returns the CEL type of the IP.
+func (i IP) Type() ref.Type {
+	return IPType
+}
+
+// Value returns the raw Go value (netip.Addr) of the IP.
+func (i IP) Value() any {
+	return i.Addr
+}
+
+type CIDR struct {
+	netip.Prefix
+}
+
+// ConvertToNative converts the CIDR value to a native Go type.
+func (c CIDR) ConvertToNative(typeDesc reflect.Type) (any, error) {
+	if typeDesc == reflect.TypeFor[netip.Prefix]() {
+		return c.Prefix, nil
+	}
+	if typeDesc.Kind() == reflect.String {
+		return c.Prefix.String(), nil
+	}
+	return nil, fmt.Errorf("unsupported type conversion to '%v'", typeDesc)
+}
+
+// ConvertToType converts the CIDR value to a CEL type.
+func (c CIDR) ConvertToType(typeValue ref.Type) ref.Val {
+	switch typeValue {
+	case types.StringType:
+		return types.String(c.Prefix.String())
+	case CIDRType:
+		return c
+	case types.TypeType:
+		return CIDRType
+	}
+	return types.NewErr("type conversion error from '%s' to '%s'", CIDRType, typeValue)
+}
+
+// Equal returns true if this CIDR is equal to the other ref.Val.
+func (c CIDR) Equal(other ref.Val) ref.Val {
+	o, ok := other.(CIDR)
+	if !ok {
+		return types.False
+	}
+	return types.Bool(c.Prefix == o.Prefix)
+}
+
+// Type returns the CEL type of the CIDR.
+func (c CIDR) Type() ref.Type {
+	return CIDRType
+}
+
+// Value returns the raw Go value (netip.Prefix) of the CIDR.
+func (c CIDR) Value() any {
+	return c.Prefix
+}
+
+// --- Static Validators ---
+
+type argChecker func(e *cel.Env, call, arg ast.Expr) error
+
+type networkFormatValidator struct {
+	funcName string
+	argNum   int
+	check    argChecker
+}
+
+func (v networkFormatValidator) Name() string {
+	return fmt.Sprintf("cel.validator.network.%s", v.funcName)
+}
+
+func (v networkFormatValidator) Validate(e *cel.Env, _ cel.ValidatorConfig, a *ast.AST, iss *cel.Issues) {
+	root := ast.NavigateAST(a)
+	funcCalls := ast.MatchDescendants(root, ast.FunctionMatcher(v.funcName))
+	for _, call := range funcCalls {
+		callArgs := call.AsCall().Args()
+		if len(callArgs) <= v.argNum {
+			continue
+		}
+		litArg := callArgs[v.argNum]
+		if litArg.Kind() != ast.LiteralKind {
+			continue
+		}
+		if err := v.check(e, call, litArg); err != nil {
+			iss.ReportErrorAtID(litArg.ID(), "invalid %s argument: %v", v.funcName, err)
+		}
+	}
+}
+
+func checkIP(e *cel.Env, call, arg ast.Expr) error {
+	pattern := arg.AsLiteral().Value().(string)
+	_, err := parseIPAddr(pattern)
+	return err
+}
+
+func checkCIDR(e *cel.Env, call, arg ast.Expr) error {
+	pattern := arg.AsLiteral().Value().(string)
+	_, err := parseCIDR(pattern)
+	return err
+}
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/ext/regex.go /work/src/external-provisioner/vendor/github.com/google/cel-go/ext/regex.go
--- a/vendor/github.com/google/cel-go/ext/regex.go	2026-09-05 00:02:32.074804362 +0000
+++ b/vendor/github.com/google/cel-go/ext/regex.go	2026-09-05 00:03:03.438974618 +0000
@@ -341,16 +341,16 @@
 			targetSize := estimateSize(c, args[0])
 			// Fixed size estimate of +1 is added for safety from zero size args.
 			// The target cost is the size of the target string, scaled by a traversal factor.
-			targetCost := targetSize.Add(checker.FixedSizeEstimate(1)).MultiplyByCostFactor(common.StringTraversalCostFactor)
+			targetCost := targetSize.Add(fixedSizeEstimate(1)).MultiplyByCostFactor(common.StringTraversalCostFactor)
 			// The regex cost is the size of the regex pattern, scaled by a complexity factor.
-			regexCost := estimateSize(c, args[1]).Add(checker.FixedSizeEstimate(1)).MultiplyByCostFactor(common.RegexStringLengthCostFactor)
+			regexCost := estimateSize(c, args[1]).Add(fixedSizeEstimate(1)).MultiplyByCostFactor(common.RegexStringLengthCostFactor)
 			// The result is a single string. Worst Case: it's the size of the entire target.
-			resultSize := &checker.SizeEstimate{Min: 0, Max: targetSize.Max}
+			resultSize := rangedSizeEstimate(0, targetSize.Max)
 			// The total cost is the search cost (target + regex) plus the allocation cost for the result string.
-			return &checker.CallEstimate{
-				CostEstimate: regexCost.Multiply(targetCost).Add(checker.CostEstimate(*resultSize)),
-				ResultSize:   resultSize,
-			}
+			return callEstimate(
+				regexCost.Multiply(targetCost).Add(checker.CostEstimate(resultSize)),
+				&resultSize,
+			)
 		}
 		return nil
 	}
@@ -362,18 +362,18 @@
 			targetSize := estimateSize(c, args[0])
 			// Fixed size estimate of +1 is added for safety from zero size args.
 			// The target cost is the size of the target string, scaled by a traversal factor.
-			targetCost := targetSize.Add(checker.FixedSizeEstimate(1)).MultiplyByCostFactor(common.StringTraversalCostFactor)
+			targetCost := targetSize.Add(fixedSizeEstimate(1)).MultiplyByCostFactor(common.StringTraversalCostFactor)
 			// The regex cost is the size of the regex pattern, scaled by a complexity factor.
-			regexCost := estimateSize(c, args[1]).Add(checker.FixedSizeEstimate(1)).MultiplyByCostFactor(common.RegexStringLengthCostFactor)
+			regexCost := estimateSize(c, args[1]).Add(fixedSizeEstimate(1)).MultiplyByCostFactor(common.RegexStringLengthCostFactor)
 			// The result is a list of strings. Worst Case: it's contents are the size of the entire target.
-			resultSize := &checker.SizeEstimate{Min: 0, Max: targetSize.Max}
+			resultSize := rangedSizeEstimate(0, targetSize.Max)
 			// The cost to allocate the result list is its base cost plus the size of its contents.
-			allocationSize := resultSize.Add(checker.FixedSizeEstimate(common.ListCreateBaseCost))
+			allocationSize := resultSize.Add(fixedSizeEstimate(common.ListCreateBaseCost))
 			// The total cost is the search cost (target + regex) plus the allocation cost for the result list.
-			return &checker.CallEstimate{
-				CostEstimate: targetCost.Multiply(regexCost).Add(checker.CostEstimate(allocationSize)),
-				ResultSize:   resultSize,
-			}
+			return callEstimate(
+				targetCost.Multiply(regexCost).Add(checker.CostEstimate(allocationSize)),
+				&resultSize,
+			)
 		}
 		return nil
 	}
@@ -382,28 +382,28 @@
 func estimateReplaceCost() checker.FunctionEstimator {
 	return func(c checker.CostEstimator, target *checker.AstNode, args []checker.AstNode) *checker.CallEstimate {
 		l := len(args)
-		if l == 3 || l == 4 {
+		if target == nil && (l == 3 || l == 4) {
 			targetSize := estimateSize(c, args[0])
 			replacementSize := estimateSize(c, args[2])
 			// Fixed size estimate of +1 is added for safety from zero size args.
 			// The target cost is the size of the target string, scaled by a traversal factor.
-			targetCost := targetSize.Add(checker.FixedSizeEstimate(1)).MultiplyByCostFactor(common.StringTraversalCostFactor)
+			targetCost := targetSize.Add(fixedSizeEstimate(1)).MultiplyByCostFactor(common.StringTraversalCostFactor)
 			// The regex cost is the size of the regex pattern, scaled by a complexity factor.
-			regexCost := estimateSize(c, args[1]).Add(checker.FixedSizeEstimate(1)).MultiplyByCostFactor(common.RegexStringLengthCostFactor)
+			regexCost := estimateSize(c, args[1]).Add(fixedSizeEstimate(1)).MultiplyByCostFactor(common.RegexStringLengthCostFactor)
 			// Estimate the potential size range of the output string. The final size could be smaller
 			// (if the replacement size is 0) or larger than the original.
 			allReplacedSize := targetSize.Max * replacementSize.Max
 			noneReplacedSize := targetSize.Max
 			// The allocation cost for the result is based on the estimated size of the output string.
-			resultSize := &checker.SizeEstimate{Min: noneReplacedSize, Max: allReplacedSize}
+			resultSize := rangedSizeEstimate(noneReplacedSize, allReplacedSize)
 			if replacementSize.Max == 0 {
-				resultSize = &checker.SizeEstimate{Min: allReplacedSize, Max: noneReplacedSize}
+				resultSize = rangedSizeEstimate(allReplacedSize, noneReplacedSize)
 			}
 			// The final cost is result of search cost (target cost + regex cost) plus the allocation cost for the output string.
-			return &checker.CallEstimate{
-				CostEstimate: targetCost.Multiply(regexCost).Add(checker.CostEstimate(*resultSize)),
-				ResultSize:   resultSize,
-			}
+			return callEstimate(
+				targetCost.Multiply(regexCost).Add(resultSize.AsCost()),
+				&resultSize,
+			)
 		}
 		return nil
 	}
@@ -411,8 +411,8 @@
 
 func extractCostTracker() interpreter.FunctionTracker {
 	return func(args []ref.Val, result ref.Val) *uint64 {
-		targetCost := float64(actualSize(args[0])+1) * common.StringTraversalCostFactor
-		regexCost := float64(actualSize(args[1])+1) * common.RegexStringLengthCostFactor
+		targetCost := float64(safeAdd(actualSize(args[0]), 1)) * common.StringTraversalCostFactor
+		regexCost := float64(safeAdd(actualSize(args[1]), 1)) * common.RegexStringLengthCostFactor
 		// Actual search cost calculation = targetCost + regexCost
 		searchCost := targetCost * regexCost
 		// The total cost is the base call cost + search cost + result string allocation.
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/ext/sets.go /work/src/external-provisioner/vendor/github.com/google/cel-go/ext/sets.go
--- a/vendor/github.com/google/cel-go/ext/sets.go	2026-09-05 00:02:32.074804362 +0000
+++ b/vendor/github.com/google/cel-go/ext/sets.go	2026-09-05 00:03:03.442974638 +0000
@@ -15,8 +15,6 @@
 package ext
 
 import (
-	"math"
-
 	"github.com/google/cel-go/cel"
 	"github.com/google/cel-go/checker"
 	"github.com/google/cel-go/common/ast"
@@ -242,37 +240,15 @@
 		arg0Size := estimateSize(estimator, args[0])
 		arg1Size := estimateSize(estimator, args[1])
 		costEstimate := arg0Size.Multiply(arg1Size).MultiplyByCostFactor(costFactor).Add(callCostEstimate)
-		return &checker.CallEstimate{CostEstimate: costEstimate}
-	}
-}
-
-func estimateSize(estimator checker.CostEstimator, node checker.AstNode) checker.SizeEstimate {
-	if l := node.ComputedSize(); l != nil {
-		return *l
-	}
-	if l := estimator.EstimateSize(node); l != nil {
-		return *l
+		return callEstimate(costEstimate, nil)
 	}
-	return checker.SizeEstimate{Min: 0, Max: math.MaxUint64}
 }
 
 func trackSetsCost(costFactor float64) interpreter.FunctionTracker {
 	return func(args []ref.Val, _ ref.Val) *uint64 {
 		lhsSize := actualSize(args[0])
 		rhsSize := actualSize(args[1])
-		cost := callCost + uint64(float64(lhsSize*rhsSize)*costFactor)
+		cost := safeAdd(callCost, uint64(float64(lhsSize*rhsSize)*costFactor))
 		return &cost
 	}
 }
-
-func actualSize(value ref.Val) uint64 {
-	if sz, ok := value.(traits.Sizer); ok {
-		return uint64(sz.Size().(types.Int))
-	}
-	return 1
-}
-
-var (
-	callCostEstimate = checker.FixedCostEstimate(1)
-	callCost         = uint64(1)
-)
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/ext/strings.go /work/src/external-provisioner/vendor/github.com/google/cel-go/ext/strings.go
--- a/vendor/github.com/google/cel-go/ext/strings.go	2026-09-05 00:02:32.074804362 +0000
+++ b/vendor/github.com/google/cel-go/ext/strings.go	2026-09-05 00:03:03.442974638 +0000
@@ -28,9 +28,12 @@
 	"golang.org/x/text/language"
 
 	"github.com/google/cel-go/cel"
+	"github.com/google/cel-go/checker"
+	"github.com/google/cel-go/common"
 	"github.com/google/cel-go/common/types"
 	"github.com/google/cel-go/common/types/ref"
 	"github.com/google/cel-go/common/types/traits"
+	"github.com/google/cel-go/interpreter"
 )
 
 const (
@@ -43,6 +46,8 @@
 //
 // # CharAt
 //
+// Introduced at version: 0 (cost support in version 5)
+//
 // Returns the character at the given position. If the position is negative, or greater than
 // the length of the string, the function will produce an error:
 //
@@ -56,7 +61,7 @@
 //
 // # Format
 //
-// Introduced at version: 1
+// Introduced at version: 1 (cost at version 5)
 //
 // Returns a new string with substitutions being performed, printf-style.
 // The valid formatting clauses are:
@@ -103,6 +108,8 @@
 //
 // # IndexOf
 //
+// Introduced at version: 0 (cost support in version 5)
+//
 // Returns the integer index of the first occurrence of the search string. If the search string is
 // not found the function returns -1.
 //
@@ -124,6 +131,8 @@
 //
 // # Join
 //
+// Introduced at version: 0 (cost support in version 5)
+//
 // Returns a new string where the elements of string list are concatenated.
 //
 // The function also accepts an optional separator which is placed between elements in the resulting string.
@@ -140,6 +149,8 @@
 //
 // # LastIndexOf
 //
+// Introduced at version: 0 (cost support in version 5)
+//
 // Returns the integer index at the start of the last occurrence of the search string. If the
 // search string is not found the function returns -1.
 //
@@ -161,6 +172,8 @@
 //
 // # LowerAscii
 //
+// Introduced at version: 0 (cost support in version 5)
+//
 // Returns a new string where all ASCII characters are lower-cased.
 //
 // This function does not perform Unicode case-mapping for characters outside the ASCII range.
@@ -174,7 +187,7 @@
 //
 // # Strings.Quote
 //
-// Introduced in version: 1
+// Introduced in version: 1 (cost support in version 5)
 //
 // Takes the given string and makes it safe to print (without any formatting due to escape sequences).
 // If any invalid UTF-8 characters are encountered, they are replaced with \uFFFD.
@@ -188,6 +201,8 @@
 //
 // # Replace
 //
+// Introduced at version: 0 (cost support in version 5)
+//
 // Returns a new string based on the target, which replaces the occurrences of a search string
 // with a replacement string if present. The function accepts an optional limit on the number of
 // substring replacements to be made.
@@ -209,6 +224,8 @@
 //
 // # Split
 //
+// Introduced at version: 0 (cost support in version 5)
+//
 // Returns a list of strings split from the input by the given separator. The function accepts
 // an optional argument specifying a limit on the number of substrings produced by the split.
 //
@@ -229,6 +246,8 @@
 //
 // # Substring
 //
+// Introduced at version: 0 (cost support in version 5)
+//
 // Returns the substring given a numeric range corresponding to character positions. Optionally
 // may omit the trailing range for a substring from a given character position until the end of
 // a string.
@@ -249,6 +268,8 @@
 //
 // # Trim
 //
+// Introduced at version: 0 (cost support in version 5)
+//
 // Returns a new string which removes the leading and trailing whitespace in the target string.
 // The trim function uses the Unicode definition of whitespace which does not include the
 // zero-width spaces. See: https://en.wikipedia.org/wiki/Whitespace_character#Unicode
@@ -261,6 +282,8 @@
 //
 // # UpperAscii
 //
+// Introduced at version: 0 (cost support in version 5)
+//
 // Returns a new string where all ASCII characters are upper-cased.
 //
 // This function does not perform Unicode case-mapping for characters outside the ASCII range.
@@ -274,7 +297,7 @@
 //
 // # Reverse
 //
-// Introduced at version: 3
+// Introduced at version: 3 (cost support in version 5)
 //
 // Returns a new string whose characters are the same as the target string, only formatted in
 // reverse order.
@@ -287,7 +310,7 @@
 //	'gums'.reverse() // returns 'smug'
 //	'John Smith'.reverse() // returns 'htimS nhoJ'
 //
-// Introduced at version: 4
+// Introduced at version: 4 (cost support in version 5)
 //
 // Formatting updated to adhere to https://github.com/google/cel-spec/blob/master/doc/extensions/strings.md.
 //
@@ -303,8 +326,9 @@
 }
 
 type stringLib struct {
-	locale  string
-	version uint32
+	locale       string
+	version      uint32
+	maxPrecision int
 }
 
 // LibraryName implements the SingletonLibrary interface method.
@@ -353,6 +377,16 @@
 	}
 }
 
+// StringsMaxPrecision configures the maximum precision for floating-point format clauses.
+//
+// If not set, the default is 100 for version >= 5, and no limit for earlier versions.
+func StringsMaxPrecision(limit int) StringsOption {
+	return func(lib *stringLib) *stringLib {
+		lib.maxPrecision = limit
+		return lib
+	}
+}
+
 // CompileOptions implements the Library interface method.
 func (lib *stringLib) CompileOptions() []cel.EnvOption {
 	formatLocale := "en_US"
@@ -470,6 +504,13 @@
 					return stringOrError(upperASCII(string(s)))
 				}))),
 	}
+	// maxPrecision is unbounded (0) for versions < 5 to maintain backward
+	// compatibility. For version >= 5, the default is 100 if not explicitly
+	// configured via StringsMaxPrecision().
+	maxPrecision := lib.maxPrecision
+	if maxPrecision == 0 && lib.version >= 5 {
+		maxPrecision = 100
+	}
 	if lib.version >= 1 {
 		if lib.version >= 4 {
 			opts = append(opts, cel.Function("format",
@@ -477,7 +518,7 @@
 					cel.FunctionBinding(func(args ...ref.Val) ref.Val {
 						s := string(args[0].(types.String))
 						formatArgs := args[1].(traits.Lister)
-						return stringOrError(parseFormatStringV2(s, &stringFormatterV2{}, &stringArgList{formatArgs}))
+						return stringOrError(parseFormatStringV2(s, &stringFormatterV2{}, &stringArgList{formatArgs}, maxPrecision))
 					}))))
 		} else {
 			opts = append(opts, cel.Function("format",
@@ -485,7 +526,7 @@
 					cel.FunctionBinding(func(args ...ref.Val) ref.Val {
 						s := string(args[0].(types.String))
 						formatArgs := args[1].(traits.Lister)
-						return stringOrError(parseFormatString(s, &stringFormatter{}, &stringArgList{formatArgs}, formatLocale))
+						return stringOrError(parseFormatString(s, &stringFormatter{}, &stringArgList{formatArgs}, formatLocale, maxPrecision))
 					}))))
 		}
 		opts = append(opts,
@@ -544,16 +585,64 @@
 	}
 	if lib.version >= 1 {
 		if lib.version >= 4 {
-			opts = append(opts, cel.ASTValidators(stringFormatValidatorV2{}))
+			opts = append(opts, cel.ASTValidators(stringFormatValidatorV2{maxPrecision: maxPrecision}))
 		} else {
-			opts = append(opts, cel.ASTValidators(stringFormatValidator{}))
+			opts = append(opts, cel.ASTValidators(stringFormatValidator{maxPrecision: maxPrecision}))
+		}
+	}
+
+	if lib.version >= 5 {
+		// Cost estimators for string extension functions.
+		estimators := []checker.CostOption{
+			// Format is captured in the core cost estimator logic and needs to be extracted out.
+			checker.OverloadCostEstimate("string_char_at_int", estimateStringCharAtCost),
+			checker.OverloadCostEstimate("string_index_of_string", estimateStringSearchCost),
+			checker.OverloadCostEstimate("string_index_of_string_int", estimateStringSearchCost),
+			checker.OverloadCostEstimate("string_last_index_of_string", estimateStringSearchCost),
+			checker.OverloadCostEstimate("string_last_index_of_string_int", estimateStringSearchCost),
+			checker.OverloadCostEstimate("string_lower_ascii", estimateStringFixedTransformCost),
+			checker.OverloadCostEstimate("string_upper_ascii", estimateStringFixedTransformCost),
+			checker.OverloadCostEstimate("string_replace_string_string", estimateStringReplaceCost),
+			checker.OverloadCostEstimate("string_replace_string_string_int", estimateStringReplaceCost),
+			checker.OverloadCostEstimate("string_split_string", estimateStringSplitCost),
+			checker.OverloadCostEstimate("string_split_string_int", estimateStringSplitCost),
+			checker.OverloadCostEstimate("string_substring_int", estimateSubstringCost),
+			checker.OverloadCostEstimate("string_substring_int_int", estimateSubstringCost),
+			checker.OverloadCostEstimate("string_trim", estimateStringVariableTransformCost),
+			checker.OverloadCostEstimate("string_reverse", estimateStringFixedTransformCost),
+			checker.OverloadCostEstimate("list_join", estimateStringJoinCost),
+			checker.OverloadCostEstimate("list_join_string", estimateStringJoinCost),
 		}
+		opts = append(opts, cel.CostEstimatorOptions(estimators...))
 	}
 	return opts
 }
 
 // ProgramOptions implements the Library interface method.
-func (*stringLib) ProgramOptions() []cel.ProgramOption {
+func (lib *stringLib) ProgramOptions() []cel.ProgramOption {
+	if lib.version >= 5 {
+		return []cel.ProgramOption{
+			cel.CostTrackerOptions(
+				interpreter.OverloadCostTracker("string_char_at_int", trackStringCharAtCost),
+				interpreter.OverloadCostTracker("string_index_of_string", trackStringSearchCost),
+				interpreter.OverloadCostTracker("string_index_of_string_int", trackStringSearchCost),
+				interpreter.OverloadCostTracker("string_last_index_of_string", trackStringSearchCost),
+				interpreter.OverloadCostTracker("string_last_index_of_string_int", trackStringSearchCost),
+				interpreter.OverloadCostTracker("string_lower_ascii", trackStringTransformCost),
+				interpreter.OverloadCostTracker("string_upper_ascii", trackStringTransformCost),
+				interpreter.OverloadCostTracker("string_replace_string_string", trackStringReplaceCost),
+				interpreter.OverloadCostTracker("string_replace_string_string_int", trackStringReplaceCost),
+				interpreter.OverloadCostTracker("string_split_string", trackStringSplitCost),
+				interpreter.OverloadCostTracker("string_split_string_int", trackStringSplitCost),
+				interpreter.OverloadCostTracker("string_substring_int", trackStringTransformCost),
+				interpreter.OverloadCostTracker("string_substring_int_int", trackStringTransformCost),
+				interpreter.OverloadCostTracker("string_trim", trackStringTransformCost),
+				interpreter.OverloadCostTracker("string_reverse", trackStringTransformCost),
+				interpreter.OverloadCostTracker("list_join", trackStringJoinCost),
+				interpreter.OverloadCostTracker("list_join_string", trackStringJoinCost),
+			),
+		}
+	}
 	return []cel.ProgramOption{}
 }
 
@@ -574,15 +663,19 @@
 }
 
 func indexOfOffset(str, substr string, offset int64) (int64, error) {
-	if substr == "" {
-		return offset, nil
-	}
 	off := int(offset)
-	runes := []rune(str)
-	subrunes := []rune(substr)
 	if off < 0 {
 		return -1, fmt.Errorf("index out of range: %d", off)
 	}
+	runes := []rune(str)
+	if substr == "" {
+		// The empty string matches at the search offset, clamped to the end of the string.
+		if off > len(runes) {
+			return int64(len(runes)), nil
+		}
+		return offset, nil
+	}
+	subrunes := []rune(substr)
 	// If the offset exceeds the length, return -1 rather than error.
 	if off >= len(runes) {
 		return -1, nil
@@ -615,15 +708,19 @@
 }
 
 func lastIndexOfOffset(str, substr string, offset int64) (int64, error) {
-	if substr == "" {
-		return offset, nil
-	}
 	off := int(offset)
-	runes := []rune(str)
-	subrunes := []rune(substr)
 	if off < 0 {
 		return -1, fmt.Errorf("index out of range: %d", off)
 	}
+	runes := []rune(str)
+	if substr == "" {
+		// The empty string matches at the search offset, clamped to the end of the string.
+		if off > len(runes) {
+			return int64(len(runes)), nil
+		}
+		return offset, nil
+	}
+	subrunes := []rune(substr)
 	// If the offset is far greater than the length return -1
 	if off >= len(runes) {
 		return -1, nil
@@ -792,5 +889,196 @@
 }
 
 var (
-	stringListType = reflect.TypeOf([]string{})
+	stringListType = reflect.TypeFor[[]string]()
 )
+
+// Cost estimation functions for string extensions.
+//
+// These functions provide compile-time cost estimates proportional to the size of
+// the input string(s), ensuring that the CEL cost system accurately reflects the
+// computational work performed by string operations.
+
+// estimateStringFixedTransformCost estimates cost for O(n) string operations such as
+// lowerAscii, upperAsciil, reverse and quote.
+func estimateStringFixedTransformCost(estimator checker.CostEstimator, target *checker.AstNode, args []checker.AstNode) *checker.CallEstimate {
+	if target == nil {
+		return nil
+	}
+	cost, size := estimateStringScan(estimateSize(estimator, *target))
+	return callEstimate(cost.Add(callCostEstimate).Add(size.AsCost()), size)
+}
+
+// estimateStringVariableTransformCost estimates cost for O(n) string operations that result
+// in a variable sized string which may be empty to the exact input string.
+func estimateStringVariableTransformCost(estimator checker.CostEstimator, target *checker.AstNode, args []checker.AstNode) *checker.CallEstimate {
+	if target == nil {
+		return nil
+	}
+	cost, size := estimateStringScan(estimateSize(estimator, *target))
+	transformSize := rangedSizeEstimate(0, size.Max)
+	return callEstimate(cost.Add(callCostEstimate).Add(transformSize.AsCost()), &transformSize)
+}
+
+// estimateStringCharAtCost includes a cost of 1 for the allocation, plus the string traversal cost.
+func estimateStringCharAtCost(estimator checker.CostEstimator, target *checker.AstNode, args []checker.AstNode) *checker.CallEstimate {
+	if target == nil || len(args) != 1 {
+		return nil
+	}
+	cost, _ := estimateStringScan(estimateSize(estimator, *target))
+	resultSize := rangedSizeEstimate(0, 1)
+	return callEstimate(cost.Add(callCostEstimate).Add(callCostEstimate), &resultSize)
+}
+
+// estimateSubstringCost estimates the cost for an O(n) traversal and allocation.
+func estimateSubstringCost(estimator checker.CostEstimator, target *checker.AstNode, args []checker.AstNode) *checker.CallEstimate {
+	if target == nil || len(args) < 1 || len(args) > 2 {
+		return nil
+	}
+	targetSize := estimateSize(estimator, *target)
+	cost, _ := estimateStringScan(targetSize)
+
+	start := nodeAsUintValue(args[0], 0)
+	end := targetSize.Max
+	if len(args) == 2 {
+		end = nodeAsUintValue(args[1], end)
+	}
+	resultSize := fixedSizeEstimate(end - start)
+	return callEstimate(cost.Add(callCostEstimate).Add(resultSize.AsCost()), &resultSize)
+}
+
+// estimateStringSearchCost estimates cost for O(n*m) string search operations
+// such as indexOf and lastIndexOf.
+func estimateStringSearchCost(estimator checker.CostEstimator, target *checker.AstNode, args []checker.AstNode) *checker.CallEstimate {
+	if target == nil || len(args) < 1 {
+		return nil
+	}
+	targetSize := estimateSize(estimator, *target)
+	needleSize := estimateSize(estimator, args[0])
+	searchSize := targetSize.Multiply(needleSize)
+	searchCost, _ := estimateStringScan(searchSize)
+	// Search cost is proportional to target size * substring size.
+	return callEstimate(searchCost.Add(callCostEstimate), nil)
+}
+
+// estimateStringReplaceCost estimates cost for string replace operations.
+// The cost accounts for search (O(n*m)) and potential output size growth.
+func estimateStringReplaceCost(estimator checker.CostEstimator, target *checker.AstNode, args []checker.AstNode) *checker.CallEstimate {
+	if target == nil || len(args) < 2 {
+		return nil
+	}
+	// Compute the search for the replacement string, by 'm' times
+	targetSize := estimateSize(estimator, *target)
+	needleSize := atLeastOne(estimateSize(estimator, args[0]))
+	searchCost := atLeastOne(targetSize).Multiply(needleSize).MultiplyByCostFactor(stringCostFactor)
+
+	replacementSize := estimateSize(estimator, args[1]).Add(fixedSizeEstimate(1))
+	allReplacedSize := safeMul(safeAdd(targetSize.Max, 1), replacementSize.Max)
+	resultMinSize := targetSize.Min
+	if resultMinSize > replacementSize.Min {
+		resultMinSize = replacementSize.Min
+	}
+	resultSize := rangedSizeEstimate(resultMinSize, allReplacedSize)
+	return callEstimate(
+		searchCost.Add(resultSize.AsCost()).Add(callCostEstimate), &resultSize,
+	)
+}
+
+// estimateStringSplitCost estimates cost for string split operations.
+// Split creates a list of substrings, so cost includes both traversal and
+// list allocation proportional to the input size.
+func estimateStringSplitCost(estimator checker.CostEstimator, target *checker.AstNode, args []checker.AstNode) *checker.CallEstimate {
+	if target == nil || len(args) < 1 {
+		return nil
+	}
+	targetSize := estimateSize(estimator, *target)
+	// Traversal cost proportional to input size.
+	traversalCost := targetSize.Add(fixedSizeEstimate(1)).MultiplyByCostFactor(stringCostFactor)
+	// Worst case: split("") produces N elements for a string of size N.
+	resultSize := rangedSizeEstimate(0, targetSize.Max)
+	// Include list creation base cost plus allocation for each element.
+	allocationCost := resultSize.MultiplyByCostFactor(1).Add(checker.FixedCostEstimate(common.ListCreateBaseCost))
+	cost := traversalCost.Add(allocationCost).Add(callCostEstimate)
+	return callEstimate(cost, &resultSize)
+}
+
+// estimateStringJoinCost estimates cost for string join operations.
+// Join iterates over all list elements and concatenates them, so cost is
+// proportional to the total size of all elements plus separator overhead.
+func estimateStringJoinCost(estimator checker.CostEstimator, target *checker.AstNode, args []checker.AstNode) *checker.CallEstimate {
+	if target == nil {
+		return nil
+	}
+	targetSize := estimateSize(estimator, *target)
+	sepSize := fixedSizeEstimate(0)
+	if len(args) >= 1 {
+		sepSize = estimateSize(estimator, args[0])
+	}
+	// Traversal cost proportional to the number of list elements.
+	traversalCost := targetSize.Add(fixedSizeEstimate(1)).MultiplyByCostFactor(stringCostFactor)
+	// Result size: sum of element sizes + (n-1) * separator size.
+	// Worst case estimate: use list size * max element size + list size * separator size.
+	maxResultSize := safeAdd(safeMul(targetSize.Max, (safeAdd(1, sepSize.Max))), sepSize.Max)
+	resultSize := rangedSizeEstimate(0, maxResultSize)
+	cost := traversalCost.Add(resultSize.MultiplyByCostFactor(1)).Add(callCostEstimate)
+	return callEstimate(cost, &resultSize)
+}
+
+// Runtime cost tracking functions for string extensions.
+//
+// These functions compute the actual cost of string operations after evaluation,
+// using the real sizes of the inputs and outputs.
+
+// trackStringCharAtCost tracks runtime cost for O(n) string operations.
+func trackStringCharAtCost(args []ref.Val, result ref.Val) *uint64 {
+	size := float64(actualSize(args[0])) * stringCostFactor
+	cost := safeAdd(callCost, uint64(math.Ceil(size)), 1)
+	return &cost
+}
+
+// trackStringTransformCost tracks runtime cost for O(n) string operations.
+func trackStringTransformCost(args []ref.Val, result ref.Val) *uint64 {
+	transformCost := math.Ceil(float64(actualSize(args[0])) * stringCostFactor)
+	resultSize := actualSize(result)
+	cost := safeAdd(callCost, uint64(transformCost), resultSize)
+	return &cost
+}
+
+// trackStringSearchCost tracks runtime cost for O(n*m) string search operations.
+func trackStringSearchCost(args []ref.Val, _ ref.Val) *uint64 {
+	searchCost := float64(actualSize(args[0])*actualSize(args[1])) * stringCostFactor
+	cost := safeAdd(uint64(math.Ceil(searchCost)), callCost)
+	return &cost
+}
+
+// trackStringReplaceCost tracks runtime cost for string replace operations,
+// accounting for search cost and the size of the result.
+func trackStringReplaceCost(args []ref.Val, result ref.Val) *uint64 {
+	targetSize := actualSize(args[0])
+	if targetSize == 0 {
+		targetSize = 1
+	}
+	needleSize := actualSize(args[1])
+	if needleSize == 0 {
+		needleSize = 1
+	}
+	searchCost := uint64(math.Ceil(float64(targetSize*needleSize) * stringCostFactor))
+	cost := safeAdd(callCost, searchCost, actualSize(result))
+	return &cost
+}
+
+// trackStringSplitCost tracks runtime cost for string split operations,
+// accounting for traversal and list allocation.
+func trackStringSplitCost(args []ref.Val, result ref.Val) *uint64 {
+	traversalCost := float64(safeAdd(actualSize(args[0]), 1)) * stringCostFactor
+	resultSize := actualSize(result)
+	cost := safeAdd(callCost, uint64(math.Ceil(traversalCost)), resultSize, common.ListCreateBaseCost)
+	return &cost
+}
+
+// trackStringJoinCost tracks runtime cost for string join operations,
+// accounting for traversal and the size of the result.
+func trackStringJoinCost(args []ref.Val, result ref.Val) *uint64 {
+	traversalCost := float64(safeAdd(actualSize(args[0]), 1)) * stringCostFactor
+	cost := safeAdd(callCost, uint64(math.Ceil(traversalCost)), actualSize(result))
+	return &cost
+}
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/interpreter/BUILD.bazel /work/src/external-provisioner/vendor/github.com/google/cel-go/interpreter/BUILD.bazel
--- a/vendor/github.com/google/cel-go/interpreter/BUILD.bazel	2026-09-05 00:02:32.074804362 +0000
+++ b/vendor/github.com/google/cel-go/interpreter/BUILD.bazel	2026-09-05 00:03:03.442974638 +0000
@@ -14,6 +14,7 @@
         "decorators.go",
         "dispatcher.go",
         "evalstate.go",
+        "frame.go",
         "interpretable.go",
         "interpreter.go",
         "optimizations.go",
@@ -47,6 +48,7 @@
         "activation_test.go",
         "attribute_patterns_test.go",
         "attributes_test.go",
+        "frame_test.go",
         "interpreter_test.go",
         "prune_test.go",
         "runtimecost_test.go",
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/interpreter/activation.go /work/src/external-provisioner/vendor/github.com/google/cel-go/interpreter/activation.go
--- a/vendor/github.com/google/cel-go/interpreter/activation.go	2026-09-05 00:02:32.074804362 +0000
+++ b/vendor/github.com/google/cel-go/interpreter/activation.go	2026-09-05 00:03:03.442974638 +0000
@@ -110,8 +110,9 @@
 // hierarchicalActivation which implements Activation and contains a parent and
 // child activation.
 type hierarchicalActivation struct {
-	parent Activation
-	child  Activation
+	parent        Activation
+	child         Activation
+	poolAllocated bool
 }
 
 // Parent implements the Activation interface method.
@@ -127,10 +128,28 @@
 	return a.parent.ResolveName(name)
 }
 
+// Unwrap returns the parent activation, stripping the local child scope.
+// This allows global disambiguation to skip past locally introduced variables.
+func (a *hierarchicalActivation) Unwrap() Activation {
+	return a.parent
+}
+
+// AsPartialActivation checks the child first via direct type assertion (to
+// avoid recursion through the folder → frame → hierarchicalActivation cycle),
+// then walks the parent hierarchy via the free function.
+func (a *hierarchicalActivation) AsPartialActivation() (PartialActivation, bool) {
+	if pv, ok := a.child.(partialActivationConverter); ok {
+		if p, ok := pv.AsPartialActivation(); ok {
+			return p, true
+		}
+	}
+	return AsPartialActivation(a.parent)
+}
+
 // NewHierarchicalActivation takes two activations and produces a new one which prioritizes
 // resolution in the child first and parent(s) second.
 func NewHierarchicalActivation(parent Activation, child Activation) Activation {
-	return &hierarchicalActivation{parent, child}
+	return &hierarchicalActivation{parent: parent, child: child, poolAllocated: false}
 }
 
 // NewPartialActivation returns an Activation which contains a list of AttributePattern values
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/interpreter/attributes.go /work/src/external-provisioner/vendor/github.com/google/cel-go/interpreter/attributes.go
--- a/vendor/github.com/google/cel-go/interpreter/attributes.go	2026-09-05 00:02:32.074804362 +0000
+++ b/vendor/github.com/google/cel-go/interpreter/attributes.go	2026-09-05 00:03:03.442974638 +0000
@@ -190,7 +190,7 @@
 func (r *attrFactory) ConditionalAttribute(id int64, expr Interpretable, t, f Attribute) Attribute {
 	return &conditionalAttribute{
 		id:      id,
-		expr:    expr,
+		expr:    adaptToV2(expr),
 		truthy:  t,
 		falsy:   f,
 		adapter: r.adapter,
@@ -225,7 +225,7 @@
 func (r *attrFactory) RelativeAttribute(id int64, operand Interpretable) Attribute {
 	return &relativeAttribute{
 		id:                     id,
-		operand:                operand,
+		operand:                adaptToV2(operand),
 		qualifiers:             []Qualifier{},
 		adapter:                r.adapter,
 		fac:                    r,
@@ -349,7 +349,7 @@
 		obj, found := v.ResolveName(nm)
 		if found {
 			if celErr, ok := obj.(*types.Err); ok {
-				return nil, celErr.Unwrap()
+				return nil, celErr
 			}
 			obj, isOpt, err := applyQualifiers(v, obj, a.qualifiers)
 			if err != nil {
@@ -384,7 +384,7 @@
 
 type conditionalAttribute struct {
 	id      int64
-	expr    Interpretable
+	expr    InterpretableV2
 	truthy  Attribute
 	falsy   Attribute
 	adapter types.Adapter
@@ -571,7 +571,7 @@
 
 type relativeAttribute struct {
 	id         int64
-	operand    Interpretable
+	operand    InterpretableV2
 	qualifiers []Qualifier
 	adapter    types.Adapter
 	fac        AttributeFactory
@@ -964,9 +964,11 @@
 		}
 	case map[int32]any:
 		isMap = true
-		obj, isKey := o[int32(i)]
-		if isKey {
-			return obj, true, nil
+		if i32 := int32(i); int64(i32) == i {
+			obj, isKey := o[i32]
+			if isKey {
+				return obj, true, nil
+			}
 		}
 	case map[int64]any:
 		isMap = true
@@ -1089,9 +1091,11 @@
 			return obj, true, nil
 		}
 	case map[uint32]any:
-		obj, isKey := o[uint32(u)]
-		if isKey {
-			return obj, true, nil
+		if u32 := uint32(u); uint64(u32) == u {
+			obj, isKey := o[u32]
+			if isKey {
+				return obj, true, nil
+			}
 		}
 	case map[uint64]any:
 		obj, isKey := o[u]
@@ -1301,7 +1305,7 @@
 		if !optObj.HasValue() {
 			return optObj, false, nil
 		}
-		obj = optObj.GetValue().Value()
+		obj = optObj.GetValue()
 	}
 
 	var err error
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/interpreter/decorators.go /work/src/external-provisioner/vendor/github.com/google/cel-go/interpreter/decorators.go
--- a/vendor/github.com/google/cel-go/interpreter/decorators.go	2026-09-05 00:02:32.074804362 +0000
+++ b/vendor/github.com/google/cel-go/interpreter/decorators.go	2026-09-05 00:03:03.442974638 +0000
@@ -25,9 +25,13 @@
 // Interpretable expression nodes at construction time.
 type InterpretableDecorator func(Interpretable) (Interpretable, error)
 
+// InterpretableDecoratorV2 is a functional interface for decorating or replacing
+// InterpretableV2 expression nodes at construction time.
+type InterpretableDecoratorV2 func(InterpretableV2) (InterpretableV2, error)
+
 // decObserveEval records evaluation state into an EvalState object.
-func decObserveEval(observer EvalObserver) InterpretableDecorator {
-	return func(i Interpretable) (Interpretable, error) {
+func decObserveEval(observer EvalObserver) InterpretableDecoratorV2 {
+	return func(i InterpretableV2) (InterpretableV2, error) {
 		switch inst := i.(type) {
 		case *evalWatch, *evalWatchAttr, *evalWatchConst, *evalWatchConstructor:
 			// these instruction are already watching, return straight-away.
@@ -49,8 +53,8 @@
 			}, nil
 		default:
 			return &evalWatch{
-				Interpretable: i,
-				observer:      observer,
+				InterpretableV2: i,
+				observer:        observer,
 			}, nil
 		}
 	}
@@ -58,8 +62,8 @@
 
 // decInterruptFolds creates an intepretable decorator which marks comprehensions as interruptable
 // where the interrupt state is communicated via a hidden variable on the Activation.
-func decInterruptFolds() InterpretableDecorator {
-	return func(i Interpretable) (Interpretable, error) {
+func decInterruptFolds() InterpretableDecoratorV2 {
+	return func(i InterpretableV2) (InterpretableV2, error) {
 		fold, ok := i.(*evalFold)
 		if !ok {
 			return i, nil
@@ -70,8 +74,8 @@
 }
 
 // decDisableShortcircuits ensures that all branches of an expression will be evaluated, no short-circuiting.
-func decDisableShortcircuits() InterpretableDecorator {
-	return func(i Interpretable) (Interpretable, error) {
+func decDisableShortcircuits() InterpretableDecoratorV2 {
+	return func(i InterpretableV2) (InterpretableV2, error) {
 		switch expr := i.(type) {
 		case *evalOr:
 			return &evalExhaustiveOr{
@@ -104,8 +108,8 @@
 // conditionally precomputing the result.
 // - build list and map values with constant elements.
 // - convert 'in' operations to set membership tests if possible.
-func decOptimize() InterpretableDecorator {
-	return func(i Interpretable) (Interpretable, error) {
+func decOptimize() InterpretableDecoratorV2 {
+	return func(i InterpretableV2) (InterpretableV2, error) {
 		switch inst := i.(type) {
 		case *evalList:
 			return maybeBuildListLiteral(i, inst)
@@ -124,7 +128,7 @@
 }
 
 // decRegexOptimizer compiles regex pattern string constants.
-func decRegexOptimizer(regexOptimizations ...*RegexOptimization) InterpretableDecorator {
+func decRegexOptimizer(regexOptimizations ...*RegexOptimization) InterpretableDecoratorV2 {
 	functionMatchMap := make(map[string]*RegexOptimization)
 	overloadMatchMap := make(map[string]*RegexOptimization)
 	for _, m := range regexOptimizations {
@@ -134,7 +138,7 @@
 		}
 	}
 
-	return func(i Interpretable) (Interpretable, error) {
+	return func(i InterpretableV2) (InterpretableV2, error) {
 		call, ok := i.(InterpretableCall)
 		if !ok {
 			return i, nil
@@ -165,7 +169,7 @@
 	}
 }
 
-func maybeOptimizeConstUnary(i Interpretable, call InterpretableCall) (Interpretable, error) {
+func maybeOptimizeConstUnary(i InterpretableV2, call InterpretableCall) (InterpretableV2, error) {
 	args := call.Args()
 	if len(args) != 1 {
 		return i, nil
@@ -181,7 +185,7 @@
 	return NewConstValue(call.ID(), val), nil
 }
 
-func maybeBuildListLiteral(i Interpretable, l *evalList) (Interpretable, error) {
+func maybeBuildListLiteral(i InterpretableV2, l *evalList) (InterpretableV2, error) {
 	for _, elem := range l.elems {
 		_, isConst := elem.(InterpretableConst)
 		if !isConst {
@@ -191,7 +195,7 @@
 	return NewConstValue(l.ID(), l.Eval(EmptyActivation())), nil
 }
 
-func maybeBuildMapLiteral(i Interpretable, mp *evalMap) (Interpretable, error) {
+func maybeBuildMapLiteral(i InterpretableV2, mp *evalMap) (InterpretableV2, error) {
 	for idx, key := range mp.keys {
 		_, isConst := key.(InterpretableConst)
 		if !isConst {
@@ -209,7 +213,7 @@
 // test if the following conditions are true:
 // - the list is a constant with homogeneous element types.
 // - the elements are all of primitive type.
-func maybeOptimizeSetMembership(i Interpretable, inlist InterpretableCall) (Interpretable, error) {
+func maybeOptimizeSetMembership(i InterpretableV2, inlist InterpretableCall) (InterpretableV2, error) {
 	args := inlist.Args()
 	lhs := args[0]
 	rhs := args[1]
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/interpreter/frame.go /work/src/external-provisioner/vendor/github.com/google/cel-go/interpreter/frame.go
--- a/vendor/github.com/google/cel-go/interpreter/frame.go	1970-01-01 00:00:00.000000000 +0000
+++ b/vendor/github.com/google/cel-go/interpreter/frame.go	2026-09-05 00:03:03.442974638 +0000
@@ -0,0 +1,327 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package interpreter
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sync"
+	"sync/atomic"
+
+	"github.com/google/cel-go/common/types/ref"
+)
+
+// evalContext contains the stateful information needed for a single evaluation.
+//
+// This state is shared across all frames within a single evaluation, including
+// child frames created for comprehension blocks.
+type evalContext struct {
+	// interrupt exposes a callback channel for cancellation.
+	interrupt <-chan struct{}
+
+	// interruptCheckCount is the number of times the interrupt channel has been checked.
+	interruptCheckCount atomic.Uint64
+
+	// interruptCheckFrequency is the frequency at which the interrupt channel is checked.
+	interruptCheckFrequency uint
+
+	// interrupted indicates whether the evaluation has been interrupted.
+	interrupted atomic.Bool
+
+	// state provides the context for tracking the evaluation state.
+	state EvalState
+
+	// costs provides the context for tracking the evaluation costs.
+	costs *CostTracker
+
+	// ctx is the context for async call implementations to use.
+	ctx context.Context
+
+	// cancel cancels the context when the evaluation is finished.
+	cancel context.CancelFunc
+}
+
+// ExecutionFrame provides the context for a single evaluation of an expression.
+//
+// The execution frame must not be stored in any fashion as its lifecycle is completely
+// controlled by the CEL evaluation process.
+type ExecutionFrame struct {
+	// Activation provides the context for resolving variables by name.
+	Activation
+
+	// parent provides the context for parent scopes (used for comprehension iterators).
+	parent *ExecutionFrame
+
+	// ctx provides the shared evaluation state across frames.
+	ctx *evalContext
+}
+
+// NewExecutionFrame creates a new execution frame from the pool.
+func NewExecutionFrame(input any) (*ExecutionFrame, error) {
+	f := frameStack.Get().(*ExecutionFrame)
+	switch v := input.(type) {
+	case Activation:
+		f.Activation = v
+	case map[string]any:
+		f.Activation = activationInput.create(v)
+	default:
+		return nil, fmt.Errorf("invalid input, wanted Activation or map[string]any, got: (%T)%v", input, input)
+	}
+	return f, nil
+}
+
+// SetContext sets the context for the execution frame.
+func (f *ExecutionFrame) SetContext(ctx context.Context, interruptCheckFrequency uint) error {
+	if f.parent != nil {
+		return errors.New("SetContext() called on child frame")
+	}
+	if f.ctx != nil {
+		return errors.New("SetContext() called more than once")
+	}
+	f.ctx = evalContextPool.Get().(*evalContext)
+	f.ctx.ctx, f.ctx.cancel = context.WithCancel(ctx)
+	f.ctx.interrupt = ctx.Done()
+	f.ctx.interruptCheckFrequency = interruptCheckFrequency
+	f.ctx.interruptCheckCount.Store(0)
+	f.ctx.interrupted.Store(false)
+	return nil
+}
+
+// Close releases the resources held by the execution frame and returns it to the pool.
+func (f *ExecutionFrame) Close() {
+	if f.parent == nil && f.ctx != nil {
+		if f.ctx.cancel != nil {
+			f.ctx.cancel()
+			f.ctx.cancel = nil
+		}
+		f.ctx.ctx = nil
+		f.ctx.interrupt = nil
+		f.ctx.state = nil
+		f.ctx.costs = nil
+		f.ctx.interrupted.Store(false)
+		f.ctx.interruptCheckCount.Store(0)
+		f.ctx.interruptCheckFrequency = 0
+		evalContextPool.Put(f.ctx)
+	}
+	f.ctx = nil
+	f.parent = nil
+	switch a := f.Activation.(type) {
+	case *hierarchicalActivation:
+		if child, ok := a.child.(*inputActivation); ok {
+			activationInput.release(child)
+		}
+		activationStack.release(a)
+	case *inputActivation:
+		activationInput.release(a)
+	}
+	f.Activation = nil
+	frameStack.Put(f)
+}
+
+// Push pushes the given activation onto the activation stack and returns the new frame.
+//
+// This operation is internal to the interpreter and is used to handle comprehension
+// scoping. The child frame inherits the shared evalContext from the parent.
+func (f *ExecutionFrame) Push(activation Activation) *ExecutionFrame {
+	child := frameStack.Get().(*ExecutionFrame)
+	child.parent = f
+	child.ctx = f.ctx
+	child.Activation = activationStack.create(f.Activation, activation)
+	return child
+}
+
+// Pop returns the parent frame, releasing the current frame back to the pool.
+func (f *ExecutionFrame) Pop() *ExecutionFrame {
+	if f.parent == nil {
+		return f
+	}
+	parent := f.parent
+	activationStack.release(f.Activation)
+	f.Activation = nil
+	f.parent = nil
+	f.ctx = nil
+	frameStack.Put(f)
+	return parent
+}
+
+// ResolveName implements the Activation interface by proxying to the internal activation.
+func (f *ExecutionFrame) ResolveName(name string) (any, bool) {
+	return f.Activation.ResolveName(name)
+}
+
+// Parent implements the Activation interface by proxying to the internal activation.
+func (f *ExecutionFrame) Parent() Activation {
+	return f.Activation.Parent()
+}
+
+// AsPartialActivation implements the PartialActivation interface by proxying to the internal activation.
+func (f *ExecutionFrame) AsPartialActivation() (PartialActivation, bool) {
+	return AsPartialActivation(f.Activation)
+}
+
+// Unwrap returns the internal activation.
+func (f *ExecutionFrame) Unwrap() Activation {
+	return f.Activation
+}
+
+// CheckInterrupt returns whether the evaluation has been interrupted.
+func (f *ExecutionFrame) CheckInterrupt() bool {
+	if f.ctx == nil {
+		return false
+	}
+	if f.ctx.interrupted.Load() {
+		return true
+	}
+	count := f.ctx.interruptCheckCount.Add(1)
+	if f.ctx.interruptCheckFrequency > 0 && count%uint64(f.ctx.interruptCheckFrequency) == 0 {
+		select {
+		case <-f.ctx.interrupt:
+			f.ctx.interrupted.Store(true)
+			return true
+		default:
+			return false
+		}
+	}
+	return false
+}
+
+// frameStack provides a synchronized pool of ExecutionFrames.
+var frameStack = &sync.Pool{
+	New: func() any {
+		return &ExecutionFrame{}
+	},
+}
+
+// evalContextPool provides a synchronized pool of evalContexts.
+var evalContextPool = &sync.Pool{
+	New: func() any {
+		return &evalContext{}
+	},
+}
+
+type activationStackPool struct {
+	sync.Pool
+}
+
+func (pool *activationStackPool) create(parent, child Activation) Activation {
+	h := pool.Get().(*hierarchicalActivation)
+	h.child = child
+	h.parent = parent
+	h.poolAllocated = true
+	return h
+}
+
+func (pool *activationStackPool) release(activation Activation) {
+	h, ok := activation.(*hierarchicalActivation)
+	if !ok || !h.poolAllocated {
+		return
+	}
+	h.parent = nil
+	h.child = nil
+	pool.Pool.Put(h)
+}
+
+func newActivationStackPool() *activationStackPool {
+	return &activationStackPool{
+		Pool: sync.Pool{
+			New: func() any {
+				return &hierarchicalActivation{}
+			},
+		},
+	}
+}
+
+type inputActivation struct {
+	vars     map[string]any
+	lazyVars map[string]any
+}
+
+// ResolveName looks up the value of the input variable name, if found.
+//
+// Lazy bindings may be supplied within the map-based input in either of the following forms:
+// - func() any
+// - func() ref.Val
+//
+// The lazy binding will only be invoked once per evaluation.
+//
+// Values which are not represented as ref.Val types on input may be adapted to a ref.Val using
+// the types.Adapter configured in the environment.
+func (a *inputActivation) ResolveName(name string) (any, bool) {
+	v, found := a.vars[name]
+	if !found {
+		return nil, false
+	}
+	switch obj := v.(type) {
+	case func() ref.Val:
+		if resolved, found := a.lazyVars[name]; found {
+			return resolved, true
+		}
+		lazy := obj()
+		a.lazyVars[name] = lazy
+		return lazy, true
+	case func() any:
+		if resolved, found := a.lazyVars[name]; found {
+			return resolved, true
+		}
+		lazy := obj()
+		a.lazyVars[name] = lazy
+		return lazy, true
+	default:
+		return obj, true
+	}
+}
+
+// Parent implements the Activation interface
+func (a *inputActivation) Parent() Activation {
+	return nil
+}
+
+func newActivationInputPool() *activationInputPool {
+	return &activationInputPool{
+		Pool: sync.Pool{
+			New: func() any {
+				return &inputActivation{
+					lazyVars: make(map[string]any),
+				}
+			},
+		},
+	}
+}
+
+type activationInputPool struct {
+	sync.Pool
+}
+
+// create initializes a pooled Activation object with the map input.
+func (p *activationInputPool) create(vars map[string]any) *inputActivation {
+	a := p.Pool.Get().(*inputActivation)
+	a.vars = vars
+	return a
+}
+
+func (p *activationInputPool) release(value any) {
+	a := value.(*inputActivation)
+	for k := range a.lazyVars {
+		delete(a.lazyVars, k)
+	}
+	a.vars = nil
+	p.Pool.Put(a)
+}
+
+var (
+	activationStack = newActivationStackPool()
+	activationInput = newActivationInputPool()
+)
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/interpreter/interpretable.go /work/src/external-provisioner/vendor/github.com/google/cel-go/interpreter/interpretable.go
--- a/vendor/github.com/google/cel-go/interpreter/interpretable.go	2026-09-05 00:02:32.074804362 +0000
+++ b/vendor/github.com/google/cel-go/interpreter/interpretable.go	2026-09-05 00:03:03.442974638 +0000
@@ -26,20 +26,53 @@
 	"github.com/google/cel-go/common/types/traits"
 )
 
-// Interpretable can accept a given Activation and produce a value along with
-// an accompanying EvalState which can be used to inspect whether additional
-// data might be necessary to complete the evaluation.
+// Interpretable evaluates an Activation and produces a value.
 type Interpretable interface {
 	// ID value corresponding to the expression node.
 	ID() int64
 
-	// Eval an Activation to produce an output.
+	// Eval evaluates an Activation and produces an output.
 	Eval(activation Activation) ref.Val
 }
 
+// InterpretableV2 evaluates an ExecutionFrame and produces a value.
+//
+// The ExecutionFrame should not be stored and should always be passed as the first
+// argument to any function as it behaves like Golang's context.Context.
+type InterpretableV2 interface {
+	Interpretable
+
+	// Exec evaluates the expression within the given ExecutionFrame.
+	Exec(frame *ExecutionFrame) ref.Val
+}
+
+// adaptToV2 adapts a V1 Interpretable implementation to the V2 interface.
+//
+// This adapter is used to bridge the legacy Interpretable interface to the
+// modern InterpretableV2 interface, providing a shim that allows the use of
+// both interfaces in the same system.
+func adaptToV2(i Interpretable) InterpretableV2 {
+	switch v := i.(type) {
+	case InterpretableV2:
+		return v
+	default:
+		return &v1Adapter{Interpretable: v}
+	}
+}
+
+// v1Adapter handles bridging a V1 Interpretable implementation to the V2 interface.
+type v1Adapter struct {
+	Interpretable
+}
+
+// Exec implements the InterpretableV2 interface method.
+func (a *v1Adapter) Exec(f *ExecutionFrame) ref.Val {
+	return a.Eval(f)
+}
+
 // InterpretableConst interface for tracking whether the Interpretable is a constant value.
 type InterpretableConst interface {
-	Interpretable
+	InterpretableV2
 
 	// Value returns the constant value of the instruction.
 	Value() ref.Val
@@ -47,7 +80,7 @@
 
 // InterpretableAttribute interface for tracking whether the Interpretable is an attribute.
 type InterpretableAttribute interface {
-	Interpretable
+	InterpretableV2
 
 	// Attr returns the Attribute value.
 	Attr() Attribute
@@ -81,7 +114,7 @@
 
 // InterpretableCall interface for inspecting Interpretable instructions related to function calls.
 type InterpretableCall interface {
-	Interpretable
+	InterpretableV2
 
 	// Function returns the function name as it appears in text or mangled operator name as it
 	// appears in the operators.go file.
@@ -94,16 +127,16 @@
 
 	// Args returns the normalized arguments to the function overload.
 	// For receiver-style functions, the receiver target is arg 0.
-	Args() []Interpretable
+	Args() []InterpretableV2
 }
 
 // InterpretableConstructor interface for inspecting Interpretable instructions that initialize a list, map
 // or struct.
 type InterpretableConstructor interface {
-	Interpretable
+	InterpretableV2
 
 	// InitVals returns all the list elements, map key and values or struct field values.
-	InitVals() []Interpretable
+	InitVals() []InterpretableV2
 
 	// Type returns the type constructed.
 	Type() ref.Type
@@ -112,18 +145,23 @@
 // ObservableInterpretable is an Interpretable which supports stateful observation, such as tracing
 // or cost-tracking.
 type ObservableInterpretable struct {
-	Interpretable
+	InterpretableV2
 	observers []StatefulObserver
 }
 
 // ID implements the Interpretable method to get the expression id associated with the step.
 func (oi *ObservableInterpretable) ID() int64 {
-	return oi.Interpretable.ID()
+	return oi.InterpretableV2.ID()
+}
+
+// Exec implements the InterpretableV2 interface method.
+func (oi *ObservableInterpretable) Exec(frame *ExecutionFrame) ref.Val {
+	return oi.ObserveExec(frame, func(any) {})
 }
 
 // Eval proxies to the ObserveEval method while invoking a no-op callback to report the observations.
 func (oi *ObservableInterpretable) Eval(vars Activation) ref.Val {
-	return oi.ObserveEval(vars, func(any) {})
+	return oi.ObserveExec(AsFrame(vars), func(any) {})
 }
 
 // ObserveEval evaluates an interpretable and performs per-evaluation state-tracking.
@@ -131,25 +169,65 @@
 // This method is concurrency safe and the expectation is that the observer function will use
 // a switch statement to determine the type of the state which has been reported back from the call.
 func (oi *ObservableInterpretable) ObserveEval(vars Activation, observer func(any)) ref.Val {
-	var err error
+	return oi.ObserveExec(AsFrame(vars), observer)
+}
+
+// ObserveExec evaluates an interpretable and performs per-evaluation state-tracking.
+//
+// This method is concurrency safe and the expectation is that the observer function will use
+// a switch statement to determine the type of the state which has been reported back from the call.
+func (oi *ObservableInterpretable) ObserveExec(frame *ExecutionFrame, observer func(any)) ref.Val {
 	// Initialize the state needed for the observers to function.
 	for _, obs := range oi.observers {
-		vars, err = obs.InitState(vars)
+		state, err := obs.InitState(frame)
 		if err != nil {
 			return types.WrapErr(err)
 		}
 		// Provide an initial reference to the state to ensure state is available
 		// even in cases of interrupting errors generated during evaluation.
-		observer(obs.GetState(vars))
+		observer(state)
 	}
-	result := oi.Interpretable.Eval(vars)
+	result := oi.InterpretableV2.Exec(frame)
 	// Get the state which needs to be reported back as having been observed.
 	for _, obs := range oi.observers {
-		observer(obs.GetState(vars))
+		observer(obs.GetState(frame))
 	}
 	return result
 }
 
+// AsFrame promotes an Activation to an ExecutionFrame.
+func AsFrame(a Activation) *ExecutionFrame {
+	if f, ok := a.(*ExecutionFrame); ok {
+		return f
+	}
+	frame := &ExecutionFrame{Activation: a}
+	// Walk the activation hierarchy to find a parent ExecutionFrame and inherit
+	// its shared context.
+	if parent := findFrame(a); parent != nil {
+		frame.ctx = parent.ctx
+	}
+	return frame
+}
+
+// findFrame walks the activation hierarchy via Unwrap and Parent to locate an
+// existing ExecutionFrame, if one exists.
+func findFrame(a Activation) *ExecutionFrame {
+	if wrapper, ok := a.(activationWrapper); ok {
+		unwrapped := wrapper.Unwrap()
+		if f, ok := unwrapped.(*ExecutionFrame); ok {
+			return f
+		}
+		return findFrame(unwrapped)
+	}
+	if p := a.Parent(); p != nil {
+		if f, ok := p.(*ExecutionFrame); ok {
+			return f
+		}
+		return findFrame(p)
+	}
+	return nil
+}
+
 // Core Interpretable implementations used during the program planning phase.
 
 type evalTestOnly struct {
@@ -162,9 +240,9 @@
 	return test.id
 }
 
-// Eval implements the Interpretable interface method.
-func (test *evalTestOnly) Eval(ctx Activation) ref.Val {
-	val, err := test.Resolve(ctx)
+// Exec implements the InterpretableV2 interface method.
+func (test *evalTestOnly) Exec(frame *ExecutionFrame) ref.Val {
+	val, err := test.Resolve(frame)
 	// Return an error if the resolve step fails
 	if err != nil {
 		return types.LabelErrNode(test.id, types.WrapErr(err))
@@ -175,6 +253,11 @@
 	return test.Adapter().NativeToValue(val)
 }
 
+// Eval implements the Interpretable interface method.
+func (test *evalTestOnly) Eval(ctx Activation) ref.Val {
+	return test.Exec(AsFrame(ctx))
+}
+
 // AddQualifier appends a qualifier that will always and only perform a presence test.
 func (test *evalTestOnly) AddQualifier(q Qualifier) (Attribute, error) {
 	cq, ok := q.(ConstantQualifier)
@@ -194,7 +277,7 @@
 	if err != nil {
 		return nil, err
 	}
-	if unk, isUnk := out.(types.Unknown); isUnk {
+	if unk, isUnk := out.(*types.Unknown); isUnk {
 		return unk, nil
 	}
 	return present, nil
@@ -230,6 +313,11 @@
 	return cons.id
 }
 
+// Exec implements the InterpretableV2 interface method.
+func (cons *evalConst) Exec(frame *ExecutionFrame) ref.Val {
+	return cons.val
+}
+
 // Eval implements the Interpretable interface method.
 func (cons *evalConst) Eval(ctx Activation) ref.Val {
 	return cons.val
@@ -242,7 +330,7 @@
 
 type evalOr struct {
 	id    int64
-	terms []Interpretable
+	terms []InterpretableV2
 }
 
 // ID implements the Interpretable interface method.
@@ -250,12 +338,12 @@
 	return or.id
 }
 
-// Eval implements the Interpretable interface method.
-func (or *evalOr) Eval(ctx Activation) ref.Val {
+// Exec implements the InterpretableV2 interface method.
+func (or *evalOr) Exec(frame *ExecutionFrame) ref.Val {
 	var err ref.Val = nil
 	var unk *types.Unknown
 	for _, term := range or.terms {
-		val := term.Eval(ctx)
+		val := term.Exec(frame)
 		boolVal, ok := val.(types.Bool)
 		// short-circuit on true.
 		if ok && boolVal == types.True {
@@ -283,9 +371,14 @@
 	return types.False
 }
 
+// Eval implements the Interpretable interface method.
+func (or *evalOr) Eval(ctx Activation) ref.Val {
+	return or.Exec(AsFrame(ctx))
+}
+
 type evalAnd struct {
 	id    int64
-	terms []Interpretable
+	terms []InterpretableV2
 }
 
 // ID implements the Interpretable interface method.
@@ -293,12 +386,12 @@
 	return and.id
 }
 
-// Eval implements the Interpretable interface method.
-func (and *evalAnd) Eval(ctx Activation) ref.Val {
+// Exec implements the InterpretableV2 interface method.
+func (and *evalAnd) Exec(frame *ExecutionFrame) ref.Val {
 	var err ref.Val = nil
 	var unk *types.Unknown
 	for _, term := range and.terms {
-		val := term.Eval(ctx)
+		val := term.Exec(frame)
 		boolVal, ok := val.(types.Bool)
 		// short-circuit on false.
 		if ok && boolVal == types.False {
@@ -326,10 +419,15 @@
 	return types.True
 }
 
+// Eval implements the Interpretable interface method.
+func (and *evalAnd) Eval(ctx Activation) ref.Val {
+	return and.Exec(AsFrame(ctx))
+}
+
 type evalEq struct {
 	id  int64
-	lhs Interpretable
-	rhs Interpretable
+	lhs InterpretableV2
+	rhs InterpretableV2
 }
 
 // ID implements the Interpretable interface method.
@@ -337,10 +435,10 @@
 	return eq.id
 }
 
-// Eval implements the Interpretable interface method.
-func (eq *evalEq) Eval(ctx Activation) ref.Val {
-	lVal := eq.lhs.Eval(ctx)
-	rVal := eq.rhs.Eval(ctx)
+// Exec implements the InterpretableV2 interface method.
+func (eq *evalEq) Exec(frame *ExecutionFrame) ref.Val {
+	lVal := eq.lhs.Exec(frame)
+	rVal := eq.rhs.Exec(frame)
 	if types.IsUnknownOrError(lVal) {
 		return lVal
 	}
@@ -350,6 +448,11 @@
 	return types.Equal(lVal, rVal)
 }
 
+// Eval implements the Interpretable interface method.
+func (eq *evalEq) Eval(ctx Activation) ref.Val {
+	return eq.Exec(AsFrame(ctx))
+}
+
 // Function implements the InterpretableCall interface method.
 func (*evalEq) Function() string {
 	return operators.Equals
@@ -361,14 +464,14 @@
 }
 
 // Args implements the InterpretableCall interface method.
-func (eq *evalEq) Args() []Interpretable {
-	return []Interpretable{eq.lhs, eq.rhs}
+func (eq *evalEq) Args() []InterpretableV2 {
+	return []InterpretableV2{eq.lhs, eq.rhs}
 }
 
 type evalNe struct {
 	id  int64
-	lhs Interpretable
-	rhs Interpretable
+	lhs InterpretableV2
+	rhs InterpretableV2
 }
 
 // ID implements the Interpretable interface method.
@@ -376,10 +479,10 @@
 	return ne.id
 }
 
-// Eval implements the Interpretable interface method.
-func (ne *evalNe) Eval(ctx Activation) ref.Val {
-	lVal := ne.lhs.Eval(ctx)
-	rVal := ne.rhs.Eval(ctx)
+// Exec implements the InterpretableV2 interface method.
+func (ne *evalNe) Exec(frame *ExecutionFrame) ref.Val {
+	lVal := ne.lhs.Exec(frame)
+	rVal := ne.rhs.Exec(frame)
 	if types.IsUnknownOrError(lVal) {
 		return lVal
 	}
@@ -389,6 +492,11 @@
 	return types.Bool(types.Equal(lVal, rVal) != types.True)
 }
 
+// Eval implements the Interpretable interface method.
+func (ne *evalNe) Eval(ctx Activation) ref.Val {
+	return ne.Exec(AsFrame(ctx))
+}
+
 // Function implements the InterpretableCall interface method.
 func (*evalNe) Function() string {
 	return operators.NotEquals
@@ -400,8 +508,8 @@
 }
 
 // Args implements the InterpretableCall interface method.
-func (ne *evalNe) Args() []Interpretable {
-	return []Interpretable{ne.lhs, ne.rhs}
+func (ne *evalNe) Args() []InterpretableV2 {
+	return []InterpretableV2{ne.lhs, ne.rhs}
 }
 
 type evalZeroArity struct {
@@ -416,9 +524,14 @@
 	return zero.id
 }
 
+// Exec implements the InterpretableV2 interface method.
+func (zero *evalZeroArity) Exec(frame *ExecutionFrame) ref.Val {
+	return types.LabelErrNode(zero.id, zero.impl())
+}
+
 // Eval implements the Interpretable interface method.
 func (zero *evalZeroArity) Eval(ctx Activation) ref.Val {
-	return types.LabelErrNode(zero.id, zero.impl())
+	return zero.Exec(AsFrame(ctx))
 }
 
 // Function implements the InterpretableCall interface method.
@@ -432,15 +545,15 @@
 }
 
 // Args returns the argument to the unary function.
-func (zero *evalZeroArity) Args() []Interpretable {
-	return []Interpretable{}
+func (zero *evalZeroArity) Args() []InterpretableV2 {
+	return []InterpretableV2{}
 }
 
 type evalUnary struct {
 	id        int64
 	function  string
 	overload  string
-	arg       Interpretable
+	arg       InterpretableV2
 	trait     int
 	impl      functions.UnaryOp
 	nonStrict bool
@@ -451,9 +564,9 @@
 	return un.id
 }
 
-// Eval implements the Interpretable interface method.
-func (un *evalUnary) Eval(ctx Activation) ref.Val {
-	argVal := un.arg.Eval(ctx)
+// Exec implements the InterpretableV2 interface method.
+func (un *evalUnary) Exec(frame *ExecutionFrame) ref.Val {
+	argVal := un.arg.Exec(frame)
 	// Early return if the argument to the function is unknown or error.
 	strict := !un.nonStrict
 	if strict && types.IsUnknownOrError(argVal) {
@@ -472,6 +585,11 @@
 	return types.NewErrWithNodeID(un.id, "no such overload: %s", un.function)
 }
 
+// Eval implements the Interpretable interface method.
+func (un *evalUnary) Eval(ctx Activation) ref.Val {
+	return un.Exec(AsFrame(ctx))
+}
+
 // Function implements the InterpretableCall interface method.
 func (un *evalUnary) Function() string {
 	return un.function
@@ -483,16 +601,16 @@
 }
 
 // Args returns the argument to the unary function.
-func (un *evalUnary) Args() []Interpretable {
-	return []Interpretable{un.arg}
+func (un *evalUnary) Args() []InterpretableV2 {
+	return []InterpretableV2{un.arg}
 }
 
 type evalBinary struct {
 	id        int64
 	function  string
 	overload  string
-	lhs       Interpretable
-	rhs       Interpretable
+	lhs       InterpretableV2
+	rhs       InterpretableV2
 	trait     int
 	impl      functions.BinaryOp
 	nonStrict bool
@@ -503,10 +621,10 @@
 	return bin.id
 }
 
-// Eval implements the Interpretable interface method.
-func (bin *evalBinary) Eval(ctx Activation) ref.Val {
-	lVal := bin.lhs.Eval(ctx)
-	rVal := bin.rhs.Eval(ctx)
+// Exec implements the InterpretableV2 interface method.
+func (bin *evalBinary) Exec(frame *ExecutionFrame) ref.Val {
+	lVal := bin.lhs.Exec(frame)
+	rVal := bin.rhs.Exec(frame)
 	// Early return if any argument to the function is unknown or error.
 	strict := !bin.nonStrict
 	if strict {
@@ -530,6 +648,11 @@
 	return types.NewErrWithNodeID(bin.id, "no such overload: %s", bin.function)
 }
 
+// Eval implements the Interpretable interface method.
+func (bin *evalBinary) Eval(ctx Activation) ref.Val {
+	return bin.Exec(AsFrame(ctx))
+}
+
 // Function implements the InterpretableCall interface method.
 func (bin *evalBinary) Function() string {
 	return bin.function
@@ -541,22 +664,22 @@
 }
 
 // Args returns the argument to the unary function.
-func (bin *evalBinary) Args() []Interpretable {
-	return []Interpretable{bin.lhs, bin.rhs}
+func (bin *evalBinary) Args() []InterpretableV2 {
+	return []InterpretableV2{bin.lhs, bin.rhs}
 }
 
 type evalVarArgs struct {
 	id        int64
 	function  string
 	overload  string
-	args      []Interpretable
+	args      []InterpretableV2
 	trait     int
 	impl      functions.FunctionOp
 	nonStrict bool
 }
 
 // NewCall creates a new call Interpretable.
-func NewCall(id int64, function, overload string, args []Interpretable, impl functions.FunctionOp) InterpretableCall {
+func NewCall(id int64, function, overload string, args []InterpretableV2, impl functions.FunctionOp) InterpretableCall {
 	return &evalVarArgs{
 		id:       id,
 		function: function,
@@ -571,13 +694,13 @@
 	return fn.id
 }
 
-// Eval implements the Interpretable interface method.
-func (fn *evalVarArgs) Eval(ctx Activation) ref.Val {
+// Exec implements the InterpretableV2 interface method.
+func (fn *evalVarArgs) Exec(frame *ExecutionFrame) ref.Val {
 	argVals := make([]ref.Val, len(fn.args))
 	// Early return if any argument to the function is unknown or error.
 	strict := !fn.nonStrict
 	for i, arg := range fn.args {
-		argVals[i] = arg.Eval(ctx)
+		argVals[i] = arg.Exec(frame)
 		if strict && types.IsUnknownOrError(argVals[i]) {
 			return argVals[i]
 		}
@@ -596,6 +719,11 @@
 	return types.NewErrWithNodeID(fn.id, "no such overload: %s %d", fn.function, fn.id)
 }
 
+// Eval implements the Interpretable interface method.
+func (fn *evalVarArgs) Eval(ctx Activation) ref.Val {
+	return fn.Exec(AsFrame(ctx))
+}
+
 // Function implements the InterpretableCall interface method.
 func (fn *evalVarArgs) Function() string {
 	return fn.function
@@ -607,13 +735,13 @@
 }
 
 // Args returns the argument to the unary function.
-func (fn *evalVarArgs) Args() []Interpretable {
+func (fn *evalVarArgs) Args() []InterpretableV2 {
 	return fn.args
 }
 
 type evalList struct {
 	id           int64
-	elems        []Interpretable
+	elems        []InterpretableV2
 	optionals    []bool
 	hasOptionals bool
 	adapter      types.Adapter
@@ -624,12 +752,12 @@
 	return l.id
 }
 
-// Eval implements the Interpretable interface method.
-func (l *evalList) Eval(ctx Activation) ref.Val {
+// Exec implements the InterpretableV2 interface method.
+func (l *evalList) Exec(frame *ExecutionFrame) ref.Val {
 	elemVals := make([]ref.Val, 0, len(l.elems))
 	// If any argument is unknown or error early terminate.
 	for i, elem := range l.elems {
-		elemVal := elem.Eval(ctx)
+		elemVal := elem.Exec(frame)
 		if types.IsUnknownOrError(elemVal) {
 			return elemVal
 		}
@@ -645,10 +773,15 @@
 		}
 		elemVals = append(elemVals, elemVal)
 	}
-	return l.adapter.NativeToValue(elemVals)
+	return types.NewRefValList(l.adapter, elemVals)
 }
 
-func (l *evalList) InitVals() []Interpretable {
+// Eval implements the Interpretable interface method.
+func (l *evalList) Eval(ctx Activation) ref.Val {
+	return l.Exec(AsFrame(ctx))
+}
+
+func (l *evalList) InitVals() []InterpretableV2 {
 	return l.elems
 }
 
@@ -658,8 +791,8 @@
 
 type evalMap struct {
 	id           int64
-	keys         []Interpretable
-	vals         []Interpretable
+	keys         []InterpretableV2
+	vals         []InterpretableV2
 	optionals    []bool
 	hasOptionals bool
 	adapter      types.Adapter
@@ -670,16 +803,16 @@
 	return m.id
 }
 
-// Eval implements the Interpretable interface method.
-func (m *evalMap) Eval(ctx Activation) ref.Val {
-	entries := make(map[ref.Val]ref.Val)
+// Exec implements the InterpretableV2 interface method.
+func (m *evalMap) Exec(frame *ExecutionFrame) ref.Val {
+	entries := make(map[ref.Val]ref.Val, len(m.keys))
 	// If any argument is unknown or error early terminate.
 	for i, key := range m.keys {
-		keyVal := key.Eval(ctx)
+		keyVal := key.Exec(frame)
 		if types.IsUnknownOrError(keyVal) {
 			return keyVal
 		}
-		valVal := m.vals[i].Eval(ctx)
+		valVal := m.vals[i].Exec(frame)
 		if types.IsUnknownOrError(valVal) {
 			return valVal
 		}
@@ -696,14 +829,19 @@
 		}
 		entries[keyVal] = valVal
 	}
-	return m.adapter.NativeToValue(entries)
+	return types.NewRefValMap(m.adapter, entries)
 }
 
-func (m *evalMap) InitVals() []Interpretable {
+// Eval implements the Interpretable interface method.
+func (m *evalMap) Eval(ctx Activation) ref.Val {
+	return m.Exec(AsFrame(ctx))
+}
+
+func (m *evalMap) InitVals() []InterpretableV2 {
 	if len(m.keys) != len(m.vals) {
 		return nil
 	}
-	result := make([]Interpretable, len(m.keys)+len(m.vals))
+	result := make([]InterpretableV2, len(m.keys)+len(m.vals))
 	idx := 0
 	for i, k := range m.keys {
 		v := m.vals[i]
@@ -723,7 +861,7 @@
 	id           int64
 	typeName     string
 	fields       []string
-	vals         []Interpretable
+	vals         []InterpretableV2
 	optionals    []bool
 	hasOptionals bool
 	provider     types.Provider
@@ -734,12 +872,12 @@
 	return o.id
 }
 
-// Eval implements the Interpretable interface method.
-func (o *evalObj) Eval(ctx Activation) ref.Val {
-	fieldVals := make(map[string]ref.Val)
+// Exec implements the InterpretableV2 interface method.
+func (o *evalObj) Exec(frame *ExecutionFrame) ref.Val {
+	fieldVals := make(map[string]ref.Val, len(o.fields))
 	// If any argument is unknown or error early terminate.
 	for i, field := range o.fields {
-		val := o.vals[i].Eval(ctx)
+		val := o.vals[i].Exec(frame)
 		if types.IsUnknownOrError(val) {
 			return val
 		}
@@ -759,8 +897,13 @@
 	return types.LabelErrNode(o.id, o.provider.NewValue(o.typeName, fieldVals))
 }
 
+// Eval implements the Interpretable interface method.
+func (o *evalObj) Eval(ctx Activation) ref.Val {
+	return o.Exec(AsFrame(ctx))
+}
+
 // InitVals implements the InterpretableConstructor interface method.
-func (o *evalObj) InitVals() []Interpretable {
+func (o *evalObj) InitVals() []InterpretableV2 {
 	return o.vals
 }
 
@@ -774,11 +917,11 @@
 	accuVar   string
 	iterVar   string
 	iterVar2  string
-	iterRange Interpretable
-	accu      Interpretable
-	cond      Interpretable
-	step      Interpretable
-	result    Interpretable
+	iterRange InterpretableV2
+	accu      InterpretableV2
+	cond      InterpretableV2
+	step      InterpretableV2
+	result    InterpretableV2
 	adapter   types.Adapter
 
 	// note an exhaustive fold will ensure that all branches are evaluated
@@ -793,13 +936,13 @@
 	return fold.id
 }
 
-// Eval implements the Interpretable interface method.
-func (fold *evalFold) Eval(ctx Activation) ref.Val {
+// Exec implements the InterpretableV2 interface method.
+func (fold *evalFold) Exec(frame *ExecutionFrame) ref.Val {
 	// Initialize the folder interface
-	f := newFolder(fold, ctx)
+	f := newFolder(fold, frame)
 	defer releaseFolder(f)
 
-	foldRange := fold.iterRange.Eval(ctx)
+	foldRange := fold.iterRange.Exec(frame)
 	if types.IsUnknownOrError(foldRange) {
 		return foldRange
 	}
@@ -824,14 +967,19 @@
 	return f.foldIterable(iterable)
 }
 
+// Eval implements the Interpretable interface method.
+func (fold *evalFold) Eval(ctx Activation) ref.Val {
+	return fold.Exec(AsFrame(ctx))
+}
+
 // Optional Interpretable implementations that specialize, subsume, or extend the core evaluation
 // plan via decorators.
 
 // evalSetMembership is an Interpretable implementation which tests whether an input value
 // exists within the set of map keys used to model a set.
 type evalSetMembership struct {
-	inst     Interpretable
-	arg      Interpretable
+	inst     InterpretableV2
+	arg      InterpretableV2
 	valueSet map[ref.Val]ref.Val
 }
 
@@ -840,9 +988,9 @@
 	return e.inst.ID()
 }
 
-// Eval implements the Interpretable interface method.
-func (e *evalSetMembership) Eval(ctx Activation) ref.Val {
-	val := e.arg.Eval(ctx)
+// Exec implements the InterpretableV2 interface method.
+func (e *evalSetMembership) Exec(frame *ExecutionFrame) ref.Val {
+	val := e.arg.Exec(frame)
 	if types.IsUnknownOrError(val) {
 		return val
 	}
@@ -852,18 +1000,28 @@
 	return types.False
 }
 
+// Eval implements the Interpretable interface method.
+func (e *evalSetMembership) Eval(ctx Activation) ref.Val {
+	return e.Exec(AsFrame(ctx))
+}
+
 // evalWatch is an Interpretable implementation that wraps the execution of a given
 // expression so that it may observe the computed value and send it to an observer.
 type evalWatch struct {
-	Interpretable
+	InterpretableV2
 	observer EvalObserver
 }
 
+// Exec implements the InterpretableV2 interface method.
+func (e *evalWatch) Exec(frame *ExecutionFrame) ref.Val {
+	val := e.InterpretableV2.Exec(frame)
+	e.observer(frame, e.ID(), e.InterpretableV2, val)
+	return val
+}
+
 // Eval implements the Interpretable interface method.
 func (e *evalWatch) Eval(vars Activation) ref.Val {
-	val := e.Interpretable.Eval(vars)
-	e.observer(vars, e.ID(), e.Interpretable, val)
-	return val
+	return e.Exec(AsFrame(vars))
 }
 
 // evalWatchAttr describes a watcher of an InterpretableAttribute Interpretable.
@@ -918,11 +1076,16 @@
 	return e, err
 }
 
+// Exec implements the InterpretableV2 interface method.
+func (e *evalWatchAttr) Exec(frame *ExecutionFrame) ref.Val {
+	val := e.InterpretableAttribute.Exec(frame)
+	e.observer(frame, e.ID(), e.InterpretableAttribute, val)
+	return val
+}
+
 // Eval implements the Interpretable interface method.
 func (e *evalWatchAttr) Eval(vars Activation) ref.Val {
-	val := e.InterpretableAttribute.Eval(vars)
-	e.observer(vars, e.ID(), e.InterpretableAttribute, val)
-	return val
+	return e.Exec(AsFrame(vars))
 }
 
 // evalWatchConstQual observes the qualification of an object using a constant boolean, int,
@@ -1049,17 +1212,22 @@
 	observer EvalObserver
 }
 
-// Eval implements the Interpretable interface method.
-func (e *evalWatchConst) Eval(vars Activation) ref.Val {
+// Exec implements the InterpretableV2 interface method.
+func (e *evalWatchConst) Exec(frame *ExecutionFrame) ref.Val {
 	val := e.Value()
-	e.observer(vars, e.ID(), e.InterpretableConst, val)
+	e.observer(frame, e.ID(), e.InterpretableConst, val)
 	return val
 }
 
+// Eval implements the Interpretable interface method.
+func (e *evalWatchConst) Eval(vars Activation) ref.Val {
+	return e.Exec(AsFrame(vars))
+}
+
 // evalExhaustiveOr is just like evalOr, but does not short-circuit argument evaluation.
 type evalExhaustiveOr struct {
 	id    int64
-	terms []Interpretable
+	terms []InterpretableV2
 }
 
 // ID implements the Interpretable interface method.
@@ -1067,13 +1235,13 @@
 	return or.id
 }
 
-// Eval implements the Interpretable interface method.
-func (or *evalExhaustiveOr) Eval(ctx Activation) ref.Val {
+// Exec implements the InterpretableV2 interface method.
+func (or *evalExhaustiveOr) Exec(frame *ExecutionFrame) ref.Val {
 	var err ref.Val = nil
 	var unk *types.Unknown
 	isTrue := false
 	for _, term := range or.terms {
-		val := term.Eval(ctx)
+		val := term.Exec(frame)
 		boolVal, ok := val.(types.Bool)
 		// flag the result as true
 		if ok && boolVal == types.True {
@@ -1103,10 +1271,15 @@
 	return types.False
 }
 
+// Eval implements the Interpretable interface method.
+func (or *evalExhaustiveOr) Eval(ctx Activation) ref.Val {
+	return or.Exec(AsFrame(ctx))
+}
+
 // evalExhaustiveAnd is just like evalAnd, but does not short-circuit argument evaluation.
 type evalExhaustiveAnd struct {
 	id    int64
-	terms []Interpretable
+	terms []InterpretableV2
 }
 
 // ID implements the Interpretable interface method.
@@ -1114,13 +1287,13 @@
 	return and.id
 }
 
-// Eval implements the Interpretable interface method.
-func (and *evalExhaustiveAnd) Eval(ctx Activation) ref.Val {
+// Exec implements the InterpretableV2 interface method.
+func (and *evalExhaustiveAnd) Exec(frame *ExecutionFrame) ref.Val {
 	var err ref.Val = nil
 	var unk *types.Unknown
 	isFalse := false
 	for _, term := range and.terms {
-		val := term.Eval(ctx)
+		val := term.Exec(frame)
 		boolVal, ok := val.(types.Bool)
 		// short-circuit on false.
 		if ok && boolVal == types.False {
@@ -1150,6 +1323,11 @@
 	return types.True
 }
 
+// Eval implements the Interpretable interface method.
+func (and *evalExhaustiveAnd) Eval(ctx Activation) ref.Val {
+	return and.Exec(AsFrame(ctx))
+}
+
 // evalExhaustiveConditional is like evalConditional, but does not short-circuit argument
 // evaluation.
 type evalExhaustiveConditional struct {
@@ -1163,11 +1341,11 @@
 	return cond.id
 }
 
-// Eval implements the Interpretable interface method.
-func (cond *evalExhaustiveConditional) Eval(ctx Activation) ref.Val {
-	cVal := cond.attr.expr.Eval(ctx)
-	tVal, tErr := cond.attr.truthy.Resolve(ctx)
-	fVal, fErr := cond.attr.falsy.Resolve(ctx)
+// Exec implements the InterpretableV2 interface method.
+func (cond *evalExhaustiveConditional) Exec(frame *ExecutionFrame) ref.Val {
+	cVal := cond.attr.expr.Exec(frame)
+	tVal, tErr := cond.attr.truthy.Resolve(frame)
+	fVal, fErr := cond.attr.falsy.Resolve(frame)
 	cBool, ok := cVal.(types.Bool)
 	if !ok {
 		return types.ValOrErr(cVal, "no such overload")
@@ -1184,6 +1362,11 @@
 	return cond.adapter.NativeToValue(fVal)
 }
 
+// Eval implements the Interpretable interface method.
+func (cond *evalExhaustiveConditional) Eval(ctx Activation) ref.Val {
+	return cond.Exec(AsFrame(ctx))
+}
+
 // evalAttr evaluates an Attribute value.
 type evalAttr struct {
 	adapter  types.Adapter
@@ -1215,15 +1398,20 @@
 	return a.adapter
 }
 
-// Eval implements the Interpretable interface method.
-func (a *evalAttr) Eval(ctx Activation) ref.Val {
-	v, err := a.attr.Resolve(ctx)
+// Exec implements the InterpretableV2 interface method.
+func (a *evalAttr) Exec(frame *ExecutionFrame) ref.Val {
+	v, err := a.attr.Resolve(frame)
 	if err != nil {
 		return types.LabelErrNode(a.ID(), types.WrapErr(err))
 	}
 	return a.adapter.NativeToValue(v)
 }
 
+// Eval implements the Interpretable interface method.
+func (a *evalAttr) Eval(ctx Activation) ref.Val {
+	return a.Exec(AsFrame(ctx))
+}
+
 // Qualify proxies to the Attribute's Qualify method.
 func (a *evalAttr) Qualify(vars Activation, obj any) (any, error) {
 	return a.attr.Qualify(vars, obj)
@@ -1249,7 +1437,7 @@
 }
 
 // InitVals implements the InterpretableConstructor InitVals function.
-func (c *evalWatchConstructor) InitVals() []Interpretable {
+func (c *evalWatchConstructor) InitVals() []InterpretableV2 {
 	return c.constructor.InitVals()
 }
 
@@ -1263,11 +1451,16 @@
 	return c.constructor.ID()
 }
 
+// Exec implements the InterpretableV2 interface method.
+func (c *evalWatchConstructor) Exec(frame *ExecutionFrame) ref.Val {
+	val := c.constructor.Exec(frame)
+	c.observer(frame, c.ID(), c.constructor, val)
+	return val
+}
+
 // Eval implements the Interpretable Eval function.
 func (c *evalWatchConstructor) Eval(vars Activation) ref.Val {
-	val := c.constructor.Eval(vars)
-	c.observer(vars, c.ID(), c.constructor, val)
-	return val
+	return c.Exec(AsFrame(vars))
 }
 
 func invalidOptionalEntryInit(field any, value ref.Val) ref.Val {
@@ -1279,10 +1472,10 @@
 }
 
 // newFolder creates or initializes a pooled folder instance.
-func newFolder(eval *evalFold, ctx Activation) *folder {
+func newFolder(eval *evalFold, frame *ExecutionFrame) *folder {
 	f := folderPool.Get().(*folder)
 	f.evalFold = eval
-	f.activation = ctx
+	f.frame = frame.Push(f)
 	return f
 }
 
@@ -1303,7 +1496,7 @@
 // cel.bind or cel.@block.
 type folder struct {
 	*evalFold
-	activation Activation
+	frame *ExecutionFrame
 
 	// fold state objects.
 	accuVal     ref.Val
@@ -1322,16 +1515,16 @@
 	for it.HasNext() == types.True {
 		f.iterVar1Val = it.Next()
 
-		cond := f.cond.Eval(f)
+		cond := f.cond.Exec(f.frame)
 		condBool, ok := cond.(types.Bool)
 		if f.interrupted || (!f.exhaustive && ok && condBool != types.True) {
 			return f.evalResult()
 		}
 
 		// Update the accumulation value and check for eval interuption.
-		f.accuVal = f.step.Eval(f)
+		f.accuVal = f.step.Exec(f.frame)
 		f.initialized = true
-		if f.interruptable && checkInterrupt(f.activation) {
+		if f.interruptable && f.frame.CheckInterrupt() {
 			f.interrupted = true
 			return f.evalResult()
 		}
@@ -1348,16 +1541,16 @@
 
 	// Terminate evaluation if evaluation is interrupted or the condition is not true and exhaustive
 	// eval is not enabled.
-	cond := f.cond.Eval(f)
+	cond := f.cond.Exec(f.frame)
 	condBool, ok := cond.(types.Bool)
 	if f.interrupted || (!f.exhaustive && ok && condBool != types.True) {
 		return false
 	}
 
 	// Update the accumulation value and check for eval interuption.
-	f.accuVal = f.step.Eval(f)
+	f.accuVal = f.step.Exec(f.frame)
 	f.initialized = true
-	if f.interruptable && checkInterrupt(f.activation) {
+	if f.interruptable && f.frame.CheckInterrupt() {
 		f.interrupted = true
 		return false
 	}
@@ -1371,7 +1564,7 @@
 	if name == f.accuVar {
 		if !f.initialized {
 			f.initialized = true
-			initVal := f.accu.Eval(f.activation)
+			initVal := f.accu.Exec(f.frame.parent)
 			if !f.exhaustive {
 				if l, isList := initVal.(traits.Lister); isList && l.Size() == types.IntZero {
 					initVal = types.NewMutableList(f.adapter)
@@ -1396,23 +1589,23 @@
 			return f.iterVar2Val, true
 		}
 	}
-	return f.activation.ResolveName(name)
+	return f.frame.parent.ResolveName(name)
 }
 
 // Parent returns the activation embedded into the folder.
 func (f *folder) Parent() Activation {
-	return f.activation
+	return f.frame.parent
 }
 
 // Unwrap returns the parent activation, thus omitting access to local state
 func (f *folder) Unwrap() Activation {
-	return f.activation
+	return f.frame.parent
 }
 
 // UnknownAttributePatterns implements the PartialActivation interface returning the unknown patterns
 // if they were provided to the input activation, or an empty set if the proxied activation is not partial.
 func (f *folder) UnknownAttributePatterns() []*AttributePattern {
-	if pv, ok := f.activation.(partialActivationConverter); ok {
+	if pv, ok := f.frame.parent.Activation.(partialActivationConverter); ok {
 		if partial, isPartial := pv.AsPartialActivation(); isPartial {
 			return partial.UnknownAttributePatterns()
 		}
@@ -1421,7 +1614,7 @@
 }
 
 func (f *folder) AsPartialActivation() (PartialActivation, bool) {
-	if pv, ok := f.activation.(partialActivationConverter); ok {
+	if pv, ok := f.frame.parent.Activation.(partialActivationConverter); ok {
 		if _, isPartial := pv.AsPartialActivation(); isPartial {
 			return f, true
 		}
@@ -1433,9 +1626,9 @@
 func (f *folder) evalResult() ref.Val {
 	f.computeResult = true
 	if f.interrupted {
-		return types.NewErr("operation interrupted")
+		return types.WrapErr(InterruptError{})
 	}
-	res := f.result.Eval(f)
+	res := f.result.Exec(f.frame)
 	// Convert a mutable list or map to an immutable one if the comprehension has generated a list or
 	// map as a result.
 	if !types.IsUnknownOrError(res) && f.mutableValue {
@@ -1452,7 +1645,8 @@
 // reset clears any state associated with folder evaluation.
 func (f *folder) reset() {
 	f.evalFold = nil
-	f.activation = nil
+	f.frame.Pop()
+	f.frame = nil
 	f.accuVal = nil
 	f.iterVar1Val = nil
 	f.iterVar2Val = nil
@@ -1463,9 +1657,18 @@
 	f.computeResult = false
 }
 
-func checkInterrupt(a Activation) bool {
-	stop, found := a.ResolveName("#interrupted")
-	return found && stop == true
+// InterruptError is a specialized error type used to signal that program evaluation should check
+// whether a context cancellation is responsible for the error.
+type InterruptError struct{}
+
+// Error returns operation interrupted.
+func (InterruptError) Error() string {
+	return "operation interrupted"
+}
+
+// Is returns whether two errors are interrupt errors.
+func (ie InterruptError) Is(target error) bool {
+	return target.Error() == ie.Error()
 }
 
 var (
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/interpreter/interpreter.go /work/src/external-provisioner/vendor/github.com/google/cel-go/interpreter/interpreter.go
--- a/vendor/github.com/google/cel-go/interpreter/interpreter.go	2026-09-05 00:02:32.074804362 +0000
+++ b/vendor/github.com/google/cel-go/interpreter/interpreter.go	2026-09-05 00:03:03.442974638 +0000
@@ -29,11 +29,11 @@
 // PlannerOption configures the program plan options during interpretable setup.
 type PlannerOption func(*planner) (*planner, error)
 
-// Interpreter generates a new Interpretable from a checked or unchecked expression.
+// Interpreter generates a new InterpretableV2 from a checked or unchecked expression.
 type Interpreter interface {
-	// NewInterpretable creates an Interpretable from a checked expression and an
+	// NewInterpretable creates an InterpretableV2 from a checked expression and an
 	// optional list of PlannerOption values.
-	NewInterpretable(exprAST *ast.AST, opts ...PlannerOption) (Interpretable, error)
+	NewInterpretable(exprAST *ast.AST, opts ...PlannerOption) (InterpretableV2, error)
 }
 
 // EvalObserver is a functional interface that accepts an expression id and an observed value.
@@ -43,16 +43,16 @@
 
 // StatefulObserver observes evaluation while tracking or utilizing stateful behavior.
 type StatefulObserver interface {
-	// InitState configures stateful metadata on the activation.
-	InitState(Activation) (Activation, error)
+	// InitState configures stateful metadata on the execution frame.
+	InitState(*ExecutionFrame) (any, error)
 
-	// GetState retrieves the stateful metadata from the activation.
-	GetState(Activation) any
+	// GetState retrieves the stateful metadata from the execution frame.
+	GetState(*ExecutionFrame) any
 
 	// Observe passes the activation and relevant evaluation metadata to the observer.
-	// The observe method is expected to do the equivalent of GetState(vars) in order
+	// The observe method is expected to do the equivalent of GetState(AsFrame(activation))
 	// to find the metadata that needs to be updated upon invocation.
-	Observe(vars Activation, id int64, programStep any, value ref.Val)
+	Observe(Activation, int64, any, ref.Val)
 }
 
 // EvalCancelledError represents a cancelled program evaluation operation.
@@ -106,37 +106,6 @@
 	}
 }
 
-// evalStateConverter identifies an object which is convertible to an EvalState instance.
-type evalStateConverter interface {
-	asEvalState() EvalState
-}
-
-// evalStateActivation hides state in the Activation in a manner not accessible to expressions.
-type evalStateActivation struct {
-	vars  Activation
-	state EvalState
-}
-
-// ResolveName proxies variable lookups to the backing activation.
-func (esa evalStateActivation) ResolveName(name string) (any, bool) {
-	return esa.vars.ResolveName(name)
-}
-
-// Parent proxies parent lookups to the backing activation.
-func (esa evalStateActivation) Parent() Activation {
-	return esa.vars
-}
-
-// AsPartialActivation supports conversion to a partial activation in order to detect unknown attributes.
-func (esa evalStateActivation) AsPartialActivation() (PartialActivation, bool) {
-	return AsPartialActivation(esa.vars)
-}
-
-// asEvalState implements the evalStateConverter method.
-func (esa evalStateActivation) asEvalState() EvalState {
-	return esa.state
-}
-
 // activationWrapper identifies an object carrying local variables which should not be exposed to the user
 // Activations used for such purposes can be unwrapped to return the activation which omits local state.
 type activationWrapper interface {
@@ -144,58 +113,57 @@
 	Unwrap() Activation
 }
 
-// asEvalState walks the Activation hierarchy and returns the first EvalState found, if present.
-func asEvalState(vars Activation) (EvalState, bool) {
-	if conv, ok := vars.(evalStateConverter); ok {
-		return conv.asEvalState(), true
-	}
-	// Check if the current activation wraps another activation. This is used to support
-	// wrappers such as the @block() activation which may be composed of a dynamicSlotActivation or a
-	// constantSlotActivation. In this case, the underlying activation is the portion which interacts
-	// with the EvalState.
-	if wrapper, ok := vars.(activationWrapper); ok {
-		unwrapped := wrapper.Unwrap()
-		// Recursively call asEvalState on the unwrapped activation. This will check the unwrapped value and its parents.
-		return asEvalState(unwrapped)
-	}
-	if vars.Parent() != nil {
-		return asEvalState(vars.Parent())
-	}
-	return nil, false
-}
-
 // evalStateFactory holds a reference to a factory function that produces an EvalState instance.
 type evalStateFactory struct {
 	factory func() EvalState
 }
 
-// InitState produces an EvalState instance and bundles it into the Activation in a way which is
+// InitState produces an EvalState instance and bundles it into the ExecutionFrame in a way which is
 // not visible to expression evaluation.
-func (et *evalStateFactory) InitState(vars Activation) (Activation, error) {
+func (et *evalStateFactory) InitState(frame *ExecutionFrame) (any, error) {
 	state := et.factory()
-	return evalStateActivation{vars: vars, state: state}, nil
+	if frame.ctx == nil {
+		frame.ctx = evalContextPool.Get().(*evalContext)
+	}
+	frame.ctx.state = state
+	return state, nil
 }
 
 // GetState extracts the EvalState from the Activation.
-func (et *evalStateFactory) GetState(vars Activation) any {
-	if state, found := asEvalState(vars); found {
-		return state
+func (et *evalStateFactory) GetState(frame *ExecutionFrame) any {
+	if frame.ctx == nil {
+		return nil
 	}
-	return nil
+	return frame.ctx.state
 }
 
 // Observe records the evaluation state for a given expression node and program step.
 func (et *evalStateFactory) Observe(vars Activation, id int64, programStep any, val ref.Val) {
-	state, found := asEvalState(vars)
-	if !found {
+	frame := AsFrame(vars)
+	if frame.ctx == nil || frame.ctx.state == nil {
 		return
 	}
-	state.SetValue(id, val)
+	frame.ctx.state.SetValue(id, val)
 }
 
 // CustomDecorator configures a custom interpretable decorator for the program.
 func CustomDecorator(dec InterpretableDecorator) PlannerOption {
 	return func(p *planner) (*planner, error) {
+		dec2 := func(i InterpretableV2) (InterpretableV2, error) {
+			legacy, err := dec(i)
+			if err != nil {
+				return nil, err
+			}
+			return adaptToV2(legacy), nil
+		}
+		p.decorators = append(p.decorators, dec2)
+		return p, nil
+	}
+}
+
+// CustomDecoratorV2 configures a custom V2 interpretable decorator for the program.
+func CustomDecoratorV2(dec InterpretableDecoratorV2) PlannerOption {
+	return func(p *planner) (*planner, error) {
 		p.decorators = append(p.decorators, dec)
 		return p, nil
 	}
@@ -207,7 +175,7 @@
 // provided to the decorator. This decorator is not thread-safe, and the EvalState
 // must be reset between Eval() calls.
 func ExhaustiveEval() PlannerOption {
-	return CustomDecorator(decDisableShortcircuits())
+	return CustomDecoratorV2(decDisableShortcircuits())
 }
 
 // InterruptableEval annotates comprehension loops with information that indicates they
@@ -216,13 +184,13 @@
 // The custom activation is currently managed higher up in the stack within the 'cel' package
 // and should not require any custom support on behalf of callers.
 func InterruptableEval() PlannerOption {
-	return CustomDecorator(decInterruptFolds())
+	return CustomDecoratorV2(decInterruptFolds())
 }
 
 // Optimize will pre-compute operations such as list and map construction and optimize
 // call arguments to set membership tests. The set of optimizations will increase over time.
 func Optimize() PlannerOption {
-	return CustomDecorator(decOptimize())
+	return CustomDecoratorV2(decOptimize())
 }
 
 // RegexOptimization provides a way to replace an InterpretableCall for a regex function when the
@@ -247,7 +215,7 @@
 // CompileRegexConstants compiles regex pattern string constants at program creation time and reports any regex pattern
 // compile errors.
 func CompileRegexConstants(regexOptimizations ...*RegexOptimization) PlannerOption {
-	return CustomDecorator(decRegexOptimizer(regexOptimizations...))
+	return CustomDecoratorV2(decRegexOptimizer(regexOptimizations...))
 }
 
 type exprInterpreter struct {
@@ -273,10 +241,10 @@
 		attrFactory: attrFactory}
 }
 
-// NewIntepretable implements the Interpreter interface method.
+// NewInterpretable implements the Interpreter interface method.
 func (i *exprInterpreter) NewInterpretable(
 	checked *ast.AST,
-	opts ...PlannerOption) (Interpretable, error) {
+	opts ...PlannerOption) (InterpretableV2, error) {
 	p := newPlanner(i.dispatcher, i.provider, i.adapter, i.attrFactory, i.container, checked)
 	var err error
 	for _, o := range opts {
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/interpreter/planner.go /work/src/external-provisioner/vendor/github.com/google/cel-go/interpreter/planner.go
--- a/vendor/github.com/google/cel-go/interpreter/planner.go	2026-09-05 00:02:32.074804362 +0000
+++ b/vendor/github.com/google/cel-go/interpreter/planner.go	2026-09-05 00:03:03.442974638 +0000
@@ -43,7 +43,7 @@
 		container:   cont,
 		refMap:      exprAST.ReferenceMap(),
 		typeMap:     exprAST.TypeMap(),
-		decorators:  make([]InterpretableDecorator, 0),
+		decorators:  make([]InterpretableDecoratorV2, 0),
 		observers:   make([]StatefulObserver, 0),
 	}
 }
@@ -57,7 +57,7 @@
 	container   *containers.Container
 	refMap      map[int64]*ast.ReferenceInfo
 	typeMap     map[int64]*types.Type
-	decorators  []InterpretableDecorator
+	decorators  []InterpretableDecoratorV2
 	observers   []StatefulObserver
 }
 
@@ -72,7 +72,7 @@
 // useful for layering functionality into the evaluation that is not natively understood by CEL,
 // such as state-tracking, expression re-write, and possibly efficient thread-safe memoization of
 // repeated expressions.
-func (p *planner) Plan(expr ast.Expr) (Interpretable, error) {
+func (p *planner) Plan(expr ast.Expr) (InterpretableV2, error) {
 	pb := &planBuilder{planner: p, localVars: make(map[string]int)}
 	i, err := pb.plan(expr)
 	if err != nil {
@@ -81,10 +81,10 @@
 	if len(p.observers) == 0 {
 		return i, nil
 	}
-	return &ObservableInterpretable{Interpretable: i, observers: p.observers}, nil
+	return &ObservableInterpretable{InterpretableV2: i, observers: p.observers}, nil
 }
 
-func (p *planBuilder) plan(expr ast.Expr) (Interpretable, error) {
+func (p *planBuilder) plan(expr ast.Expr) (InterpretableV2, error) {
 	switch expr.Kind() {
 	case ast.CallKind:
 		return p.decorate(p.planCall(expr))
@@ -109,7 +109,7 @@
 // decorate applies the InterpretableDecorator functions to the given Interpretable.
 // Both the Interpretable and error generated by a Plan step are accepted as arguments
 // for convenience.
-func (p *planBuilder) decorate(i Interpretable, err error) (Interpretable, error) {
+func (p *planBuilder) decorate(i InterpretableV2, err error) (InterpretableV2, error) {
 	if err != nil {
 		return nil, err
 	}
@@ -123,7 +123,7 @@
 }
 
 // planIdent creates an Interpretable that resolves an identifier from an Activation.
-func (p *planBuilder) planIdent(expr ast.Expr) (Interpretable, error) {
+func (p *planBuilder) planIdent(expr ast.Expr) (InterpretableV2, error) {
 	// Establish whether the identifier is in the reference map.
 	if identRef, found := p.refMap[expr.ID()]; found {
 		return p.planCheckedIdent(expr.ID(), identRef)
@@ -142,7 +142,7 @@
 	}, nil
 }
 
-func (p *planBuilder) planCheckedIdent(id int64, identRef *ast.ReferenceInfo) (Interpretable, error) {
+func (p *planBuilder) planCheckedIdent(id int64, identRef *ast.ReferenceInfo) (InterpretableV2, error) {
 	// Plan a constant reference if this is the case for this simple identifier.
 	if identRef.Value != nil {
 		return NewConstValue(id, identRef.Value), nil
@@ -171,7 +171,7 @@
 //	a) selects a field from a map or proto.
 //	b) creates a field presence test for a select within a has() macro.
 //	c) resolves the select expression to a namespaced identifier.
-func (p *planBuilder) planSelect(expr ast.Expr) (Interpretable, error) {
+func (p *planBuilder) planSelect(expr ast.Expr) (InterpretableV2, error) {
 	// If the Select id appears in the reference map from the CheckedExpr proto then it is either
 	// a namespaced identifier or enum value.
 	if identRef, found := p.refMap[expr.ID()]; found {
@@ -227,7 +227,7 @@
 // planCall creates a callable Interpretable while specializing for common functions and invocation
 // patterns. Specifically, conditional operators &&, ||, ?:, and (in)equality functions result in
 // optimized Interpretable values.
-func (p *planBuilder) planCall(expr ast.Expr) (Interpretable, error) {
+func (p *planBuilder) planCall(expr ast.Expr) (InterpretableV2, error) {
 	call := expr.AsCall()
 	target, fnName, oName := p.resolveFunction(expr)
 	argCount := len(call.Args())
@@ -237,7 +237,7 @@
 		offset++
 	}
 
-	args := make([]Interpretable, argCount)
+	args := make([]InterpretableV2, argCount)
 	if target != nil {
 		arg, err := p.plan(target)
 		if err != nil {
@@ -307,7 +307,7 @@
 func (p *planBuilder) planCallZero(expr ast.Expr,
 	function string,
 	overload string,
-	impl *functions.Overload) (Interpretable, error) {
+	impl *functions.Overload) (InterpretableV2, error) {
 	if impl == nil || impl.Function == nil {
 		return nil, fmt.Errorf("no such overload: %s()", function)
 	}
@@ -324,7 +324,7 @@
 	function string,
 	overload string,
 	impl *functions.Overload,
-	args []Interpretable) (Interpretable, error) {
+	args []InterpretableV2) (InterpretableV2, error) {
 	var fn functions.UnaryOp
 	var trait int
 	var nonStrict bool
@@ -352,7 +352,7 @@
 	function string,
 	overload string,
 	impl *functions.Overload,
-	args []Interpretable) (Interpretable, error) {
+	args []InterpretableV2) (InterpretableV2, error) {
 	var fn functions.BinaryOp
 	var trait int
 	var nonStrict bool
@@ -381,7 +381,7 @@
 	function string,
 	overload string,
 	impl *functions.Overload,
-	args []Interpretable) (Interpretable, error) {
+	args []InterpretableV2) (InterpretableV2, error) {
 	var fn functions.FunctionOp
 	var trait int
 	var nonStrict bool
@@ -405,7 +405,7 @@
 }
 
 // planCallEqual generates an equals (==) Interpretable.
-func (p *planBuilder) planCallEqual(expr ast.Expr, args []Interpretable) (Interpretable, error) {
+func (p *planBuilder) planCallEqual(expr ast.Expr, args []InterpretableV2) (InterpretableV2, error) {
 	return &evalEq{
 		id:  expr.ID(),
 		lhs: args[0],
@@ -414,7 +414,7 @@
 }
 
 // planCallNotEqual generates a not equals (!=) Interpretable.
-func (p *planBuilder) planCallNotEqual(expr ast.Expr, args []Interpretable) (Interpretable, error) {
+func (p *planBuilder) planCallNotEqual(expr ast.Expr, args []InterpretableV2) (InterpretableV2, error) {
 	return &evalNe{
 		id:  expr.ID(),
 		lhs: args[0],
@@ -423,7 +423,7 @@
 }
 
 // planCallLogicalAnd generates a logical and (&&) Interpretable.
-func (p *planBuilder) planCallLogicalAnd(expr ast.Expr, args []Interpretable) (Interpretable, error) {
+func (p *planBuilder) planCallLogicalAnd(expr ast.Expr, args []InterpretableV2) (InterpretableV2, error) {
 	return &evalAnd{
 		id:    expr.ID(),
 		terms: args,
@@ -431,7 +431,7 @@
 }
 
 // planCallLogicalOr generates a logical or (||) Interpretable.
-func (p *planBuilder) planCallLogicalOr(expr ast.Expr, args []Interpretable) (Interpretable, error) {
+func (p *planBuilder) planCallLogicalOr(expr ast.Expr, args []InterpretableV2) (InterpretableV2, error) {
 	return &evalOr{
 		id:    expr.ID(),
 		terms: args,
@@ -439,7 +439,7 @@
 }
 
 // planCallConditional generates a conditional / ternary (c ? t : f) Interpretable.
-func (p *planBuilder) planCallConditional(expr ast.Expr, args []Interpretable) (Interpretable, error) {
+func (p *planBuilder) planCallConditional(expr ast.Expr, args []InterpretableV2) (InterpretableV2, error) {
 	cond := args[0]
 	t := args[1]
 	var tAttr Attribute
@@ -467,7 +467,7 @@
 
 // planCallIndex either extends an attribute with the argument to the index operation, or creates
 // a relative attribute based on the return of a function call or operation.
-func (p *planBuilder) planCallIndex(expr ast.Expr, args []Interpretable, optional bool) (Interpretable, error) {
+func (p *planBuilder) planCallIndex(expr ast.Expr, args []InterpretableV2, optional bool) (InterpretableV2, error) {
 	op := args[0]
 	ind := args[1]
 	opType := p.typeMap[op.ID()]
@@ -502,7 +502,7 @@
 }
 
 // planCreateList generates a list construction Interpretable.
-func (p *planBuilder) planCreateList(expr ast.Expr) (Interpretable, error) {
+func (p *planBuilder) planCreateList(expr ast.Expr) (InterpretableV2, error) {
 	list := expr.AsList()
 	optionalIndices := list.OptionalIndices()
 	elements := list.Elements()
@@ -513,7 +513,7 @@
 		}
 		optionals[index] = true
 	}
-	elems := make([]Interpretable, len(elements))
+	elems := make([]InterpretableV2, len(elements))
 	for i, elem := range elements {
 		elemVal, err := p.plan(elem)
 		if err != nil {
@@ -531,12 +531,12 @@
 }
 
 // planCreateStruct generates a map or object construction Interpretable.
-func (p *planBuilder) planCreateMap(expr ast.Expr) (Interpretable, error) {
+func (p *planBuilder) planCreateMap(expr ast.Expr) (InterpretableV2, error) {
 	m := expr.AsMap()
 	entries := m.Entries()
 	optionals := make([]bool, len(entries))
-	keys := make([]Interpretable, len(entries))
-	vals := make([]Interpretable, len(entries))
+	keys := make([]InterpretableV2, len(entries))
+	vals := make([]InterpretableV2, len(entries))
 	hasOptionals := false
 	for i, e := range entries {
 		entry := e.AsMapEntry()
@@ -565,7 +565,7 @@
 }
 
 // planCreateObj generates an object construction Interpretable.
-func (p *planBuilder) planCreateStruct(expr ast.Expr) (Interpretable, error) {
+func (p *planBuilder) planCreateStruct(expr ast.Expr) (InterpretableV2, error) {
 	obj := expr.AsStruct()
 	typeName, defined := p.resolveTypeName(obj.TypeName())
 	if !defined {
@@ -574,7 +574,7 @@
 	objFields := obj.Fields()
 	optionals := make([]bool, len(objFields))
 	fields := make([]string, len(objFields))
-	vals := make([]Interpretable, len(objFields))
+	vals := make([]InterpretableV2, len(objFields))
 	hasOptionals := false
 	for i, f := range objFields {
 		field := f.AsStructField()
@@ -599,7 +599,7 @@
 }
 
 // planComprehension generates an Interpretable fold operation.
-func (p *planBuilder) planComprehension(expr ast.Expr) (Interpretable, error) {
+func (p *planBuilder) planComprehension(expr ast.Expr) (InterpretableV2, error) {
 	fold := expr.AsComprehension()
 	accu, err := p.plan(fold.AccuInit())
 	if err != nil {
@@ -639,7 +639,7 @@
 }
 
 // planConst generates a constant valued Interpretable.
-func (p *planBuilder) planConst(expr ast.Expr) (Interpretable, error) {
+func (p *planBuilder) planConst(expr ast.Expr) (InterpretableV2, error) {
 	return NewConstValue(expr.ID(), expr.AsLiteral()), nil
 }
 
@@ -726,7 +726,7 @@
 
 // relativeAttr indicates that the attribute in this case acts as a qualifier and as such needs to
 // be observed to ensure that it's evaluation value is properly recorded for state tracking.
-func (p *planBuilder) relativeAttr(id int64, eval Interpretable, opt bool) (InterpretableAttribute, error) {
+func (p *planBuilder) relativeAttr(id int64, eval InterpretableV2, opt bool) (InterpretableAttribute, error) {
 	eAttr, ok := eval.(InterpretableAttribute)
 	if !ok {
 		eAttr = &evalAttr{
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/interpreter/runtimecost.go /work/src/external-provisioner/vendor/github.com/google/cel-go/interpreter/runtimecost.go
--- a/vendor/github.com/google/cel-go/interpreter/runtimecost.go	2026-09-05 00:02:32.074804362 +0000
+++ b/vendor/github.com/google/cel-go/interpreter/runtimecost.go	2026-09-05 00:03:03.442974638 +0000
@@ -62,48 +62,6 @@
 	}
 }
 
-// costTrackerConverter identifies an object which is convertible to a CostTracker instance.
-type costTrackerConverter interface {
-	asCostTracker() *CostTracker
-}
-
-// costTrackActivation hides state in the Activation in a manner not accessible to expressions.
-type costTrackActivation struct {
-	vars        Activation
-	costTracker *CostTracker
-}
-
-// ResolveName proxies variable lookups to the backing activation.
-func (cta costTrackActivation) ResolveName(name string) (any, bool) {
-	return cta.vars.ResolveName(name)
-}
-
-// Parent proxies parent lookups to the backing activation.
-func (cta costTrackActivation) Parent() Activation {
-	return cta.vars
-}
-
-// AsPartialActivation supports conversion to a partial activation in order to detect unknown attributes.
-func (cta costTrackActivation) AsPartialActivation() (PartialActivation, bool) {
-	return AsPartialActivation(cta.vars)
-}
-
-// asCostTracker implements the costTrackerConverter method.
-func (cta costTrackActivation) asCostTracker() *CostTracker {
-	return cta.costTracker
-}
-
-// asCostTracker walks the Activation hierarchy and returns the first cost tracker found, if present.
-func asCostTracker(vars Activation) (*CostTracker, bool) {
-	if conv, ok := vars.(costTrackerConverter); ok {
-		return conv.asCostTracker(), true
-	}
-	if vars.Parent() != nil {
-		return asCostTracker(vars.Parent())
-	}
-	return nil, false
-}
-
 // costTrackerFactory holds a factory for producing new CostTracker instances on each Eval call.
 type costTrackerFactory struct {
 	factory func() (*CostTracker, error)
@@ -111,27 +69,37 @@
 
 // InitState produces a CostTracker and bundles it into an Activation in a way which is not visible
 // to expression evaluation.
-func (ct *costTrackerFactory) InitState(vars Activation) (Activation, error) {
+func (ct *costTrackerFactory) InitState(frame *ExecutionFrame) (any, error) {
 	tracker, err := ct.factory()
 	if err != nil {
 		return nil, err
 	}
-	return costTrackActivation{vars: vars, costTracker: tracker}, nil
+	if frame.ctx == nil {
+		frame.ctx = evalContextPool.Get().(*evalContext)
+	}
+	frame.ctx.costs = tracker
+	return tracker, nil
 }
 
 // GetState extracts the CostTracker from the Activation.
-func (ct *costTrackerFactory) GetState(vars Activation) any {
-	if tracker, found := asCostTracker(vars); found {
-		return tracker
+func (ct *costTrackerFactory) GetState(frame *ExecutionFrame) any {
+	if frame == nil || frame.ctx == nil {
+		return nil
 	}
-	return nil
+	return frame.ctx.costs
 }
 
 // Observe computes the incremental cost of each step and records it into the CostTracker associated
 // with the evaluation.
 func (ct *costTrackerFactory) Observe(vars Activation, id int64, programStep any, val ref.Val) {
-	tracker, found := asCostTracker(vars)
-	if !found {
+	frame := AsFrame(vars)
+	state := ct.GetState(frame)
+	if state == nil {
+		return
+	}
+	tracker, ok := state.(*CostTracker)
+	if !ok {
+		// The state is configured with CostTrackFactory so this shouldn't happen.
 		return
 	}
 	switch t := programStep.(type) {
@@ -265,6 +233,19 @@
 	stack refValStack
 }
 
+// Clone makes a shallow copy of the tracker.
+// The different clones can be used independently from
+// each other.
+func (c *CostTracker) Clone() (*CostTracker, error) {
+	tracker := &CostTracker{
+		Estimator:           c.Estimator,
+		overloadTrackers:    c.overloadTrackers,
+		Limit:               c.Limit,
+		presenceTestHasCost: c.presenceTestHasCost,
+	}
+	return tracker, nil
+}
+
 // ActualCost returns the runtime cost
 func (c *CostTracker) ActualCost() uint64 {
 	return c.cost
@@ -292,7 +273,9 @@
 	// if user has their own implementation of ActualCostEstimator, make sure to cover the mapping between overloadId and cost calculation
 	switch call.OverloadID() {
 	// O(n) functions
-	case overloads.StartsWithString, overloads.EndsWithString, overloads.StringToBytes, overloads.BytesToString, overloads.ExtQuoteString, overloads.ExtFormatString:
+	case overloads.StartsWithString, overloads.EndsWithString:
+		cost += uint64(math.Ceil(float64(actualSize(args[1])) * common.StringTraversalCostFactor))
+	case overloads.StringToBytes, overloads.BytesToString, overloads.ExtQuoteString, overloads.ExtFormatString:
 		cost += uint64(math.Ceil(float64(actualSize(args[0])) * common.StringTraversalCostFactor))
 	case overloads.InList:
 		// If a list is composed entirely of constant values this is O(1), but we don't account for that here.
@@ -317,7 +300,7 @@
 		// In the worst case scenario, we would need to reallocate a new backing store and copy both operands over.
 		cost += uint64(math.Ceil(float64(actualSize(args[0])+actualSize(args[1])) * common.StringTraversalCostFactor))
 	// O(nm) functions
-	case overloads.MatchesString:
+	case overloads.Matches, overloads.MatchesString:
 		// https://swtch.com/~rsc/regexp/regexp1.html applies to RE2 implementation supported by CEL
 		// Add one to string length for purposes of cost calculation to prevent product of string and regex to be 0
 		// in case where string is empty but regex is still expensive.
@@ -397,7 +380,7 @@
 // the stack.
 // WARNING: It is possible for multiple expressions with the same ID to exist (due to how macros are implemented) so it's
 // possible that a dropped ID will remain on the stack.  They should be removed when IDs on the stack are popped.
-func (s *refValStack) dropArgs(args []Interpretable) ([]ref.Val, bool) {
+func (s *refValStack) dropArgs(args []InterpretableV2) ([]ref.Val, bool) {
 	result := make([]ref.Val, len(args))
 argloop:
 	for nIdx := len(args) - 1; nIdx >= 0; nIdx-- {
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/parser/parser.go /work/src/external-provisioner/vendor/github.com/google/cel-go/parser/parser.go
--- a/vendor/github.com/google/cel-go/parser/parser.go	2026-09-05 00:02:32.074804362 +0000
+++ b/vendor/github.com/google/cel-go/parser/parser.go	2026-09-05 00:03:03.446974659 +0000
@@ -42,6 +42,7 @@
 func NewParser(opts ...Option) (*Parser, error) {
 	p := &Parser{}
 	p.enableHiddenAccumulatorName = true
+	p.enableIdentEscapeSyntax = true
 	for _, opt := range opts {
 		if err := opt(&p.options); err != nil {
 			return nil, err
diff -Nur /work/src-orig/external-provisioner/vendor/github.com/google/cel-go/parser/unparser.go /work/src/external-provisioner/vendor/github.com/google/cel-go/parser/unparser.go
--- a/vendor/github.com/google/cel-go/parser/unparser.go	2026-09-05 00:02:32.074804362 +0000
+++ b/vendor/github.com/google/cel-go/parser/unparser.go	2026-09-05 00:03:03.446974659 +0000
@@ -297,7 +297,7 @@
 		// represent the float using the minimum required digits
 		d := strconv.FormatFloat(float64(val), 'g', -1, 64)
 		un.str.WriteString(d)
-		if !strings.Contains(d, ".") {
+		if !strings.ContainsAny(d, ".eE") {
 			un.str.WriteString(".0")
 		}
 	case types.Int:
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/crypto/internal/poly1305/mac_noasm.go /work/src/external-provisioner/vendor/golang.org/x/crypto/internal/poly1305/mac_noasm.go
--- a/vendor/golang.org/x/crypto/internal/poly1305/mac_noasm.go	2026-09-05 00:02:32.146804718 +0000
+++ b/vendor/golang.org/x/crypto/internal/poly1305/mac_noasm.go	2026-09-05 00:03:04.406979558 +0000
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build (!amd64 && !loong64 && !ppc64le && !ppc64 && !s390x) || !gc || purego
+//go:build (!amd64 && !loong64 && !ppc64le && !ppc64 && !riscv64 && !s390x) || !gc || purego
 
 package poly1305
 
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/crypto/internal/poly1305/sum_asm.go /work/src/external-provisioner/vendor/golang.org/x/crypto/internal/poly1305/sum_asm.go
--- a/vendor/golang.org/x/crypto/internal/poly1305/sum_asm.go	2026-09-05 00:02:32.146804718 +0000
+++ b/vendor/golang.org/x/crypto/internal/poly1305/sum_asm.go	2026-09-05 00:03:04.406979558 +0000
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build gc && !purego && (amd64 || loong64 || ppc64 || ppc64le)
+//go:build gc && !purego && (amd64 || loong64 || ppc64 || ppc64le || riscv64)
 
 package poly1305
 
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/crypto/internal/poly1305/sum_riscv64.s /work/src/external-provisioner/vendor/golang.org/x/crypto/internal/poly1305/sum_riscv64.s
--- a/vendor/golang.org/x/crypto/internal/poly1305/sum_riscv64.s	1970-01-01 00:00:00.000000000 +0000
+++ b/vendor/golang.org/x/crypto/internal/poly1305/sum_riscv64.s	2026-09-05 00:03:04.406979558 +0000
@@ -0,0 +1,158 @@
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build gc && !purego
+
+#define LOAD64U(base, offset, t0, t1, t2, t3, dst) \
+	MOVBU	(offset+0*1)(base), t0; \
+	MOVBU	(offset+1*1)(base), t1; \
+	MOVBU	(offset+2*1)(base), t2; \
+	MOVBU	(offset+3*1)(base), t3; \
+	SLL	$8, t1; \
+	SLL	$16, t2; \
+	SLL	$24, t3; \
+	OR	t1, t0; \
+	OR	t3, t2; \
+	OR	t2, t0, dst; \
+	MOVBU	(offset+4*1)(base), t0; \
+	MOVBU	(offset+5*1)(base), t1; \
+	MOVBU	(offset+6*1)(base), t2; \
+	MOVBU	(offset+7*1)(base), t3; \
+	SLL	$32, t0; \
+	SLL	$40, t1; \
+	SLL	$48, t2; \
+	SLL	$56, t3; \
+	OR	t1, t0; \
+	OR	t3, t2; \
+	OR	t2, t0; \
+	OR	t0, dst
+
+// func update(state *macState, msg []byte)
+TEXT ·update(SB), $0-32
+	MOV	state+0(FP), X5
+	MOV	msg_base+8(FP), X6
+	MOV	msg_len+16(FP), X7
+
+	MOV	$16, X8
+
+	AND	$7, X6, X28
+
+	MOV	(0*8)(X5), X9		// h0
+	MOV	(1*8)(X5), X10		// h1
+	MOV	(2*8)(X5), X11		// h2
+	MOV	(3*8)(X5), X12		// r0
+	MOV	(4*8)(X5), X13		// r1
+
+	BLT	X7, X8, tail
+
+loop:
+	BEQZ	X28, aligned_load
+
+	LOAD64U(X6, 0*8, X16, X18, X19, X20, X15)	// msg[0:8]
+	LOAD64U(X6, 1*8, X16, X18, X19, X20, X17)	// msg[8:16]
+	JMP	block
+
+aligned_load:
+	MOV	(0*8)(X6), X15		// msg[0:8]
+	MOV	(1*8)(X6), X17		// msg[8:16]
+
+block:
+	ADD	X15, X9		// h0 (x1 + y1 = z1', if z1' < x1 then z1' overflow)
+	SLTU	X15, X9, X19	// h0.carry
+	ADD	X17, X10, X22
+	SLTU	X17, X22, X23
+	ADD	X22, X19, X10	// h1
+	SLTU	X22, X10, X19
+	OR	X23, X19	// h1.carry
+	ADD	$1, X19
+	ADD	X19, X11	// h2
+
+	ADD	$16, X6		// msg = msg[16:]
+
+multiply:
+	MULHU	X9, X12, X16	// h0r0.hi
+	MUL	X9, X12, X15	// h0r0.lo
+	MULHU	X10, X12, X17	// h1r0.hi
+	MUL	X10, X12, X14	// h1r0.lo
+	ADD	X14, X16
+	SLTU	X14, X16, X19
+	ADD	X19, X17
+	MUL	X11, X12, X20
+	ADD	X17, X20
+	MULHU	X9, X13, X17	// h0r1.hi
+	MUL	X9, X13, X14	// h0r1.lo
+	ADD	X14, X16
+	SLTU	X14, X16, X19
+	ADD	X19, X17
+	MOV	X17, X9
+	MUL	X11, X13, X21	// h2r1
+	MULHU	X10, X13, X17	// h1r1.hi
+	MUL	X10, X13, X14	// h1r1.lo
+	ADD	X14, X20
+	ADD	X17, X21, X22
+	SLTU	X14, X20, X19
+	ADD	X22, X19, X21
+	ADD	X9, X20
+	SLTU	X9, X20, X19
+	ADD	X19, X21
+	AND	$3, X20, X11
+	AND	$-4, X20, X18
+	ADD	X18, X15, X9
+	ADD	X21, X16, X22
+	SLTU	X18, X9, X19
+	SLTU	X21, X22, X23
+	ADD	X22, X19, X10
+	SLTU	X22, X10, X19
+	OR	X19, X23, X19
+	ADD	X19, X11
+	SLL	$62, X21, X22
+	SRL	$2, X20, X23
+	SRL	$2, X21, X21
+	OR	X22, X23, X20
+	ADD	X20, X9, X9
+	ADD	X21, X10, X22
+	SLTU	X20, X9, X19
+	SLTU	X21, X22, X23
+	ADD	X22, X19, X10
+	SLTU	X22, X10, X19
+	OR	X19, X23, X19
+	ADD	X19, X11, X11
+
+	SUB	$16, X7, X7
+	BGE	X7, X8, loop
+
+tail:
+	BEQ	X7, X0, done
+	MOV	$1, X15
+	MOV $0, X16
+	ADD	X7, X6, X6
+
+flush_buffer:
+	MOVBU	-1(X6), X20
+	SRL	$56, X15, X19
+	SLL	$8, X16, X23
+	SLL	$8, X15, X15
+	OR	X19, X23, X16
+	XOR	X20, X15
+	SUB	$1, X7, X7
+	SUB	$1, X6, X6
+	BNE	X7, X0, flush_buffer
+
+	ADD	X15, X9
+	SLTU	X15, X9, X19
+	ADD	X16, X10, X22
+	SLTU	X16, X22, X23
+	ADD	X22, X19, X10
+	SLTU	X22, X10, X19
+	OR	X23, X19
+	ADD	X19, X11
+
+	MOV	$16, X7
+	JMP	multiply
+
+done:
+	MOV	X9, (0*8)(X5)	// h0
+	MOV	X10, (1*8)(X5)
+	MOV	X11, (2*8)(X5)
+	RET
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/crypto/ssh/certs.go /work/src/external-provisioner/vendor/golang.org/x/crypto/ssh/certs.go
--- a/vendor/golang.org/x/crypto/ssh/certs.go	2026-09-05 00:02:32.150804738 +0000
+++ b/vendor/golang.org/x/crypto/ssh/certs.go	2026-09-05 00:03:04.406979558 +0000
@@ -10,6 +10,7 @@
 	"fmt"
 	"io"
 	"net"
+	"slices"
 	"sort"
 	"time"
 )
@@ -229,15 +230,20 @@
 		return nil, err
 	}
 	c.Reserved = g.Reserved
+	// Reject a certificate whose signature key is itself a certificate before
+	// parsing it. Certificates signed by certificates are not supported (see
+	// PROTOCOL.certkeys), and rejecting after ParsePublicKey returns would allow
+	// a chain of nested certificates to recurse once per level, exhausting the
+	// goroutine stack.
+	if sigAlgo, _, ok := parseString(g.SignatureKey); !ok {
+		return nil, errShortRead
+	} else if _, ok := certKeyAlgoNames[string(sigAlgo)]; ok {
+		return nil, fmt.Errorf("ssh: the signature key type %q is invalid for certificates", sigAlgo)
+	}
 	k, err := ParsePublicKey(g.SignatureKey)
 	if err != nil {
 		return nil, err
 	}
-	// The Type() function is intended to return only certificate key types, but
-	// we use certKeyAlgoNames anyway for safety, to match [Certificate.Type].
-	if _, ok := certKeyAlgoNames[k.Type()]; ok {
-		return nil, fmt.Errorf("ssh: the signature key type %q is invalid for certificates", k.Type())
-	}
 	c.SignatureKey = k
 	c.Signature, rest, ok = parseSignatureBody(g.Signature)
 	if !ok || len(rest) > 0 {
@@ -300,8 +306,11 @@
 // minimally, the IsAuthority callback should be set.
 type CertChecker struct {
 	// SupportedCriticalOptions lists the CriticalOptions that the
-	// server application layer understands. These are only used
-	// for user certificates.
+	// application layer understands. A certificate carrying a critical
+	// option that is not listed here is rejected.
+	// CertChecker.Authenticate additionally accepts the source-address
+	// option, which the server enforces on the Permissions that
+	// Authenticate returns.
 	SupportedCriticalOptions []string
 
 	// IsUserAuthority should return true if the key is recognized as an
@@ -364,8 +373,9 @@
 	return c.CheckCert(hostname, cert)
 }
 
-// Authenticate checks a user certificate. Authenticate can be used as
-// a value for ServerConfig.PublicKeyCallback.
+// Authenticate checks a user certificate. Authenticate can be used as a value
+// for ServerConfig.PublicKeyCallback. The source-address critical option is
+// allowed, as it will be enforced by the server.
 func (c *CertChecker) Authenticate(conn ConnMetadata, pubKey PublicKey) (*Permissions, error) {
 	cert, ok := pubKey.(*Certificate)
 	if !ok {
@@ -384,8 +394,11 @@
 	if !c.IsUserAuthority(cert.SignatureKey) {
 		return nil, fmt.Errorf("ssh: certificate signed by unrecognized authority")
 	}
-
-	if err := c.CheckCert(conn.User(), cert); err != nil {
+	// The source-address critical option is enforced by serverAuthenticate,
+	// so it is supported regardless of SupportedCriticalOptions
+	cc := *c
+	cc.SupportedCriticalOptions = append(slices.Clip(cc.SupportedCriticalOptions), sourceAddressCriticalOption)
+	if err := cc.CheckCert(conn.User(), cert); err != nil {
 		return nil, err
 	}
 
@@ -393,27 +406,15 @@
 }
 
 // CheckCert checks CriticalOptions, ValidPrincipals, revocation, timestamp and
-// the signature of the certificate.
+// the signature of the certificate. Critical options that are not listed in
+// SupportedCriticalOptions are rejected.
 func (c *CertChecker) CheckCert(principal string, cert *Certificate) error {
 	if c.IsRevoked != nil && c.IsRevoked(cert) {
 		return fmt.Errorf("ssh: certificate serial %d revoked", cert.Serial)
 	}
 
 	for opt := range cert.CriticalOptions {
-		// sourceAddressCriticalOption will be enforced by
-		// serverAuthenticate
-		if opt == sourceAddressCriticalOption {
-			continue
-		}
-
-		found := false
-		for _, supp := range c.SupportedCriticalOptions {
-			if supp == opt {
-				found = true
-				break
-			}
-		}
-		if !found {
+		if !slices.Contains(c.SupportedCriticalOptions, opt) {
 			return fmt.Errorf("ssh: unsupported critical option %q in certificate", opt)
 		}
 	}
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/crypto/ssh/channel.go /work/src/external-provisioner/vendor/golang.org/x/crypto/ssh/channel.go
--- a/vendor/golang.org/x/crypto/ssh/channel.go	2026-09-05 00:02:32.150804738 +0000
+++ b/vendor/golang.org/x/crypto/ssh/channel.go	2026-09-05 00:03:04.406979558 +0000
@@ -173,6 +173,12 @@
 	// (for outbound channels) or received (for inbound channels).
 	decided bool
 
+	// established is set to true once the channel is open and may carry normal
+	// channel traffic: for an outbound channel when the peer's open
+	// confirmation is received, for an inbound channel when the local side
+	// accepts it. It is set and read from different goroutines.
+	established atomic.Bool
+
 	// direction contains either channelOutbound, for channels created
 	// locally, or channelInbound, for channels created by the peer.
 	direction channelDirection
@@ -216,6 +222,10 @@
 	// packetPool has a buffer for each extended channel ID to
 	// save allocations during writes.
 	packetPool map[uint32][]byte
+
+	// closeOnce guards close so it is idempotent: closing the internal Go
+	// channels (msg, incomingRequests) more than once would panic.
+	closeOnce sync.Once
 }
 
 // writePacket sends a packet. If the packet is a channel close, it updates
@@ -340,7 +350,18 @@
 	if extended == 1 {
 		ch.extPending.write(data)
 	} else if extended > 0 {
-		// discard other extended data.
+		// RFC 4254, Section 5.2 defines no extended data types other
+		// than stderr (type 1, handled above) and this package provides
+		// no API to read them, so the data is discarded. Credit its
+		// window back immediately: it can never be read, so the
+		// deduction above would otherwise shrink the window permanently.
+		// adjustWindow returns io.EOF if the local side has already
+		// sent a channel close; ignore it like ReadExtended does, since
+		// an error returned here would terminate the mux read loop and
+		// tear down the whole connection.
+		if err := ch.adjustWindow(length); err != nil && err != io.EOF {
+			return err
+		}
 	} else {
 		ch.pending.write(data)
 	}
@@ -393,17 +414,19 @@
 }
 
 func (c *channel) close() {
-	c.pending.eof()
-	c.extPending.eof()
-	close(c.msg)
-	close(c.incomingRequests)
-	c.writeMu.Lock()
-	// This is not necessary for a normal channel teardown, but if
-	// there was another error, it is.
-	c.sentClose = true
-	c.writeMu.Unlock()
-	// Unblock writers.
-	c.remoteWin.close()
+	c.closeOnce.Do(func() {
+		c.pending.eof()
+		c.extPending.eof()
+		close(c.msg)
+		close(c.incomingRequests)
+		c.writeMu.Lock()
+		// This is not necessary for a normal channel teardown, but if
+		// there was another error, it is.
+		c.sentClose = true
+		c.writeMu.Unlock()
+		// Unblock writers.
+		c.remoteWin.close()
+	})
 }
 
 // responseMessageReceived is called when a success or failure message is
@@ -417,10 +440,20 @@
 		return errors.New("ssh: duplicate response received for channel")
 	}
 	ch.decided = true
+	ch.established.Store(true)
 	return nil
 }
 
 func (ch *channel) handlePacket(packet []byte) error {
+	// Only the open response is expected before the channel is established.
+	if !ch.established.Load() {
+		switch packet[0] {
+		case msgChannelOpenConfirm, msgChannelOpenFailure:
+		default:
+			return nil
+		}
+	}
+
 	switch packet[0] {
 	case msgChannelData, msgChannelExtendedData:
 		return ch.handleData(packet)
@@ -486,26 +519,28 @@
 		default:
 		}
 	default:
-		ch.msg <- msg
+		// No other message type is expected on an established channel.
+		return fmt.Errorf("ssh: unexpected message type %d on channel %d", packet[0], ch.localId)
 	}
 	return nil
 }
 
 func (m *mux) newChannel(chanType string, direction channelDirection, extraData []byte) *channel {
 	ch := &channel{
-		remoteWin:        window{Cond: newCond()},
-		myWindow:         channelWindowSize,
-		pending:          newBuffer(),
-		extPending:       newBuffer(),
-		direction:        direction,
-		incomingRequests: make(chan *Request, chanSize),
-		msg:              make(chan interface{}, chanSize),
-		chanType:         chanType,
-		extraData:        extraData,
-		mux:              m,
-		packetPool:       make(map[uint32][]byte),
+		remoteWin:          window{Cond: newCond()},
+		myWindow:           channelWindowSize,
+		maxIncomingPayload: channelMaxPacket,
+		pending:            newBuffer(),
+		extPending:         newBuffer(),
+		direction:          direction,
+		incomingRequests:   make(chan *Request, chanSize),
+		msg:                make(chan interface{}, chanSize),
+		chanType:           chanType,
+		extraData:          extraData,
+		mux:                m,
+		packetPool:         make(map[uint32][]byte),
 	}
-	ch.localId = m.chanList.add(ch)
+	m.chanList.add(ch)
 	return ch
 }
 
@@ -529,7 +564,6 @@
 	if ch.decided {
 		return nil, nil, errDecidedAlready
 	}
-	ch.maxIncomingPayload = channelMaxPacket
 	confirm := channelOpenConfirmMsg{
 		PeersID:       ch.remoteId,
 		MyID:          ch.localId,
@@ -537,6 +571,7 @@
 		MaxPacketSize: ch.maxIncomingPayload,
 	}
 	ch.decided = true
+	ch.established.Store(true)
 	if err := ch.sendMessage(confirm); err != nil {
 		return nil, nil, err
 	}
@@ -634,7 +669,10 @@
 	drain:
 		for {
 			select {
-			case <-ch.msg:
+			case _, ok := <-ch.msg:
+				if !ok {
+					break drain
+				}
 			default:
 				break drain
 			}
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/crypto/ssh/client.go /work/src/external-provisioner/vendor/golang.org/x/crypto/ssh/client.go
--- a/vendor/golang.org/x/crypto/ssh/client.go	2026-09-05 00:02:32.150804738 +0000
+++ b/vendor/golang.org/x/crypto/ssh/client.go	2026-09-05 00:03:04.406979558 +0000
@@ -88,6 +88,32 @@
 	return conn, conn.mux.incomingChannels, conn.mux.incomingRequests, nil
 }
 
+// NewControlClientConn establishes an SSH connection over an OpenSSH
+// ControlMaster socket c in proxy mode.
+//
+// Note that this package only implements the client side of the multiplexing
+// protocol. The provided net.Conn must be a local, secure connection (such as a
+// Unix domain socket) connected to an already-running OpenSSH process acting as
+// the ControlMaster.
+//
+// WARNING: Because proxy mode bypasses the standard cryptographic handshake
+// passing a standard network connection (e.g., TCP) will result in plaintext
+// data leakage.
+//
+// The Request and NewChannel channels must be serviced or the connection
+// will hang.
+func NewControlClientConn(c net.Conn) (Conn, <-chan NewChannel, <-chan *Request, error) {
+	conn := &connection{
+		sshConn: sshConn{conn: c},
+	}
+	var err error
+	if conn.transport, err = handshakeControlProxy(c); err != nil {
+		return nil, nil, nil, fmt.Errorf("ssh: control proxy handshake failed: %w", err)
+	}
+	conn.mux = newMux(conn.transport)
+	return conn, conn.mux.incomingChannels, conn.mux.incomingRequests, nil
+}
+
 // clientHandshake performs the client side key exchange. See RFC 4253 Section
 // 7.
 func (c *connection) clientHandshake(dialAddress string, config *ClientConfig) error {
@@ -197,6 +223,59 @@
 // the server. A BannerCallback receives the message sent by the remote server.
 type BannerCallback func(message string) error
 
+// ClientAuthContext contains information about the current state of the
+// authentication process, passed to [ClientAuthCallback].
+type ClientAuthContext struct {
+	// Metadata contains the connection metadata.
+	Metadata ConnMetadata
+
+	// Algorithms contains the negotiated algorithms.
+	Algorithms NegotiatedAlgorithms
+
+	// AllowedMethods lists the authentication methods currently accepted
+	// by the server. These are the protocol-level names defined in RFC 4252
+	// such as "publickey", "password".
+	AllowedMethods []string
+
+	// PartialSuccessMethods lists the authentication methods that have already
+	// succeeded, indicating a multi-step authentication flow. This list
+	// represents the exact sequence of partial successes and may contain
+	// duplicates if the same method succeeded multiple times.
+	PartialSuccessMethods []string
+
+	// TriedMethods lists the methods that have already been attempted and
+	// failed during this session. This list represents the exact sequence of
+	// failures and may contain duplicates. This allows the callback to also
+	// track the number of failed attempts for a specific method.
+	TriedMethods []string
+}
+
+// ClientAuthCallback is a hook invoked before each authentication attempt. It
+// allows the client to dynamically select an authentication method based on the
+// current context, server capabilities, or previous failures.
+//
+// The callback is invoked after the initial "none" authentication method, once
+// the server's supported authentication methods are known.
+//
+// Return values:
+//   - (AuthMethod, nil): The client will attempt this specific method next.
+//     The returned method does NOT need to be present in [ClientConfig.Auth].
+//     This allows for dynamic authentication strategies (e.g., prompting
+//     for a password only if public key auth fails). Callers should inspect
+//     [ClientAuthContext.TriedMethods] to avoid repeatedly returning the
+//     same failing method.
+//   - (nil, nil): The client selects from [ClientConfig.Auth] the first
+//     instance of a method that has not been tried yet, or aborts if none
+//     are left. If authentication is not successful, the callback is invoked
+//     again before the following attempt.
+//   - (nil, error): The authentication process is aborted immediately,
+//     causing the ongoing SSH handshake to fail with the provided error.
+//
+// To bound resource use, the client caps the total number of authentication
+// attempts (failures and partial successes combined) at 64. If the cap is
+// exceeded the handshake aborts with an error.
+type ClientAuthCallback func(ctx *ClientAuthContext) (AuthMethod, error)
+
 // A ClientConfig structure is used to configure a Client. It must not be
 // modified after having been passed to an SSH function.
 type ClientConfig struct {
@@ -210,6 +289,9 @@
 	// Auth contains possible authentication methods to use with the
 	// server. Only the first instance of a particular RFC 4252 method will
 	// be used during authentication.
+	//
+	// If AuthCallback is set, these AuthMethod are only used if the
+	// callback returns nil.
 	Auth []AuthMethod
 
 	// HostKeyCallback is called during the cryptographic
@@ -240,6 +322,9 @@
 	//
 	// A Timeout of zero means no timeout.
 	Timeout time.Duration
+
+	// AuthCallback, if non-nil, is invoked before each authentication attempt.
+	AuthCallback ClientAuthCallback
 }
 
 // InsecureIgnoreHostKey returns a function that can be used for
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/crypto/ssh/client_auth.go /work/src/external-provisioner/vendor/golang.org/x/crypto/ssh/client_auth.go
--- a/vendor/golang.org/x/crypto/ssh/client_auth.go	2026-09-05 00:02:32.150804738 +0000
+++ b/vendor/golang.org/x/crypto/ssh/client_auth.go	2026-09-05 00:03:04.406979558 +0000
@@ -21,6 +21,12 @@
 	authSuccess
 )
 
+// maxAuthClientTried bounds the total number of authentication attempts
+// (failures and partial successes combined) the client makes before
+// aborting the loop, to prevent unbounded growth when an AuthCallback
+// keeps supplying methods.
+const maxAuthClientTried = 64
+
 // clientAuthenticate authenticates with the remote server. See RFC 4252.
 func (c *connection) clientAuthenticate(config *ClientConfig) error {
 	// initiate user auth session
@@ -67,32 +73,62 @@
 	// then any untried methods suggested by the server.
 	var tried []string
 	var lastMethods []string
+	var partialSuccess []string
 
 	sessionID := c.transport.getSessionID()
 	for auth := AuthMethod(new(noneAuth)); auth != nil; {
 		ok, methods, err := auth.auth(sessionID, config.User, c.transport, config.Rand, extensions)
 		if err != nil {
 			// On disconnect, return error immediately
-			if _, ok := err.(*disconnectMsg); ok {
+			if _, isDisconnect := err.(*disconnectMsg); isDisconnect {
 				return err
 			}
-			// We return the error later if there is no other method left to
-			// try.
+			// We return the error later if there is no other method
+			// left to try.
 			ok = authFailure
 		}
-		if ok == authSuccess {
-			// success
+
+		switch ok {
+		case authSuccess:
 			return nil
-		} else if ok == authFailure {
-			if m := auth.method(); !slices.Contains(tried, m) {
-				tried = append(tried, m)
-			}
+		case authPartialSuccess:
+			partialSuccess = append(partialSuccess, auth.method())
+		case authFailure:
+			tried = append(tried, auth.method())
+		}
+		if len(partialSuccess)+len(tried) > maxAuthClientTried {
+			return fmt.Errorf("ssh: too many authentication attempts (%d), aborting",
+				len(partialSuccess)+len(tried))
 		}
+
 		if methods == nil {
 			methods = lastMethods
 		}
 		lastMethods = methods
 
+		// If AuthCallback is set it takes precedence: it picks the next
+		// AuthMethod dynamically. The returned method need not be in
+		// config.Auth. If the callback returns (nil, nil) we fall back to
+		// selecting the next untried method from config.Auth below; on
+		// (nil, error) the handshake aborts.
+		if config.AuthCallback != nil {
+			ctx := &ClientAuthContext{
+				Metadata:              c,
+				Algorithms:            c.Algorithms(),
+				AllowedMethods:        slices.Clone(methods),
+				PartialSuccessMethods: slices.Clone(partialSuccess),
+				TriedMethods:          slices.Clone(tried),
+			}
+			altAuth, cbErr := config.AuthCallback(ctx)
+			if cbErr != nil {
+				return cbErr
+			}
+			if altAuth != nil {
+				auth = altAuth
+				continue
+			}
+		}
+
 		auth = nil
 
 	findNext:
@@ -377,11 +413,11 @@
 			return authFailure, nil, err
 		}
 
-		// If authentication succeeds or the list of available methods does not
-		// contain the "publickey" method, do not attempt to authenticate with any
-		// other keys.  According to RFC 4252 Section 7, the latter can occur when
-		// additional authentication methods are required.
-		if success == authSuccess || !slices.Contains(methods, cb.method()) {
+		// If authentication succeeds or partially succeeds, return immediately
+		// so the caller can select the next auth method. According to RFC 4252
+		// Section 7, if the server no longer lists "publickey" among its
+		// allowed methods, do not attempt to authenticate with any other keys.
+		if success == authSuccess || success == authPartialSuccess || !slices.Contains(methods, cb.method()) {
 			return success, methods, err
 		}
 	}
@@ -762,7 +798,7 @@
 			return authFailure, nil, fmt.Errorf("GSS-API Error:\n"+
 				"Major Status: %d\n"+
 				"Minor Status: %d\n"+
-				"Error Message: %s\n", userAuthGSSAPIErrorResp.MajorStatus, userAuthGSSAPIErrorResp.MinorStatus,
+				"Error Message: %q\n", userAuthGSSAPIErrorResp.MajorStatus, userAuthGSSAPIErrorResp.MinorStatus,
 				userAuthGSSAPIErrorResp.Message)
 		case msgUserAuthGSSAPIToken:
 			userAuthGSSAPITokenReq := &userAuthGSSAPIToken{}
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/crypto/ssh/common.go /work/src/external-provisioner/vendor/golang.org/x/crypto/ssh/common.go
--- a/vendor/golang.org/x/crypto/ssh/common.go	2026-09-05 00:02:32.150804738 +0000
+++ b/vendor/golang.org/x/crypto/ssh/common.go	2026-09-05 00:03:04.406979558 +0000
@@ -419,7 +419,7 @@
 }
 
 func (a *AlgorithmNegotiationError) Error() string {
-	return fmt.Sprintf("ssh: no common algorithm for %s; we offered: %v, peer offered: %v",
+	return fmt.Sprintf("ssh: no common algorithm for %s; we offered: %q, peer offered: %q",
 		a.What, a.SupportedAlgorithms, a.RequestedAlgorithms)
 }
 
@@ -544,7 +544,7 @@
 	if c.Rand == nil {
 		c.Rand = rand.Reader
 	}
-	if c.Ciphers == nil {
+	if len(c.Ciphers) == 0 {
 		c.Ciphers = defaultCiphers
 	}
 	var ciphers []string
@@ -556,7 +556,7 @@
 	}
 	c.Ciphers = ciphers
 
-	if c.KeyExchanges == nil {
+	if len(c.KeyExchanges) == 0 {
 		c.KeyExchanges = defaultKexAlgos
 	}
 	var kexs []string
@@ -571,7 +571,7 @@
 	}
 	c.KeyExchanges = kexs
 
-	if c.MACs == nil {
+	if len(c.MACs) == 0 {
 		c.MACs = defaultMACs
 	}
 	var macs []string
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/crypto/ssh/connection.go /work/src/external-provisioner/vendor/golang.org/x/crypto/ssh/connection.go
--- a/vendor/golang.org/x/crypto/ssh/connection.go	2026-09-05 00:02:32.150804738 +0000
+++ b/vendor/golang.org/x/crypto/ssh/connection.go	2026-09-05 00:03:04.406979558 +0000
@@ -17,7 +17,7 @@
 }
 
 func (e *OpenChannelError) Error() string {
-	return fmt.Sprintf("ssh: rejected: %s (%s)", e.Reason, e.Message)
+	return fmt.Sprintf("ssh: rejected: %s (%q)", e.Reason, e.Message)
 }
 
 // ConnMetadata holds metadata for the connection.
@@ -91,9 +91,17 @@
 	}
 }
 
+// A connTransport represents the transport for a connection.
+type connTransport interface {
+	packetConn
+	getAlgorithms() NegotiatedAlgorithms
+	getSessionID() []byte
+	waitSession() error
+}
+
 // A connection represents an incoming connection.
 type connection struct {
-	transport *handshakeTransport
+	transport connTransport
 	sshConn
 
 	// The connection protocol.
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/crypto/ssh/control.go /work/src/external-provisioner/vendor/golang.org/x/crypto/ssh/control.go
--- a/vendor/golang.org/x/crypto/ssh/control.go	1970-01-01 00:00:00.000000000 +0000
+++ b/vendor/golang.org/x/crypto/ssh/control.go	2026-09-05 00:03:04.406979558 +0000
@@ -0,0 +1,155 @@
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package ssh
+
+import (
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+
+	"golang.org/x/crypto/cryptobyte"
+)
+
+const (
+	muxProtocolVersion = 4
+
+	muxMsgHello = 0x00000001
+	muxCProxy   = 0x1000000f
+	muxSProxy   = 0x8000000f
+)
+
+const controlProxyRequestID = 0
+
+// handshakeControlProxy attempts to establish a transport connection with an
+// OpenSSH ControlMaster socket in proxy mode. For details see:
+// https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.mux
+func handshakeControlProxy(rw io.ReadWriteCloser) (connTransport, error) {
+	if err := controlProxyWritePacket(rw, func(b *cryptobyte.Builder) {
+		b.AddUint32(muxMsgHello)
+		b.AddUint32(muxProtocolVersion)
+	}); err != nil {
+		return nil, fmt.Errorf("mux hello write failed: %w", err)
+	}
+	if err := controlProxyWritePacket(rw, func(b *cryptobyte.Builder) {
+		b.AddUint32(muxCProxy)
+		b.AddUint32(controlProxyRequestID)
+	}); err != nil {
+		return nil, fmt.Errorf("mux client proxy write failed: %w", err)
+	}
+
+	messageType, body, err := controlProxyReadMessage(rw)
+	if err != nil {
+		return nil, fmt.Errorf("mux hello read failed: %w", err)
+	}
+	if messageType != muxMsgHello {
+		return nil, fmt.Errorf("expected hello response, got %v", messageType)
+	}
+	var v uint32
+	if !body.ReadUint32(&v) {
+		return nil, errors.New("EOF reading mux protocol version")
+	}
+	if v != muxProtocolVersion {
+		return nil, fmt.Errorf("mux server has unsupported version %v", v)
+	}
+	messageType, body, err = controlProxyReadMessage(rw)
+	if err != nil {
+		return nil, fmt.Errorf("mux server proxy read failed: %w", err)
+	}
+	if messageType != muxSProxy {
+		return nil, fmt.Errorf("expected server proxy response, got %v", messageType)
+	}
+	var reqID uint32
+	if !body.ReadUint32(&reqID) {
+		return nil, errors.New("EOF reading request id")
+	}
+	if reqID != controlProxyRequestID {
+		return nil, fmt.Errorf("expected request id %v, got %v", controlProxyRequestID, reqID)
+	}
+	return &controlProxyTransport{rw}, nil
+}
+
+// controlProxyTransport implements the connTransport interface for
+// ControlMaster connections. Each controlMessage has zero length padding and
+// no MAC.
+type controlProxyTransport struct {
+	rw io.ReadWriteCloser
+}
+
+func (p *controlProxyTransport) Close() error {
+	return p.rw.Close()
+}
+
+func (p *controlProxyTransport) writePacket(controlMessage []byte) error {
+	return controlProxyWritePacket(p.rw, func(b *cryptobyte.Builder) {
+		b.AddUint8(0) // Padding length.
+		b.AddBytes(controlMessage)
+	})
+}
+
+func (p *controlProxyTransport) readPacket() ([]byte, error) {
+	buf, err := controlProxyReadPacket(p.rw)
+	if err != nil {
+		return nil, fmt.Errorf("ssh: error reading control message: %w", err)
+	}
+	// Discard the padding length.
+	if len(buf) < 1 {
+		return nil, errors.New("ssh: EOF reading padding length")
+	}
+	if buf[0] != 0 {
+		return nil, errors.New("ssh: unexpected non-zero padding in control message")
+	}
+	return buf[1:], nil
+}
+
+func (p *controlProxyTransport) getAlgorithms() NegotiatedAlgorithms {
+	return NegotiatedAlgorithms{}
+}
+
+func (p *controlProxyTransport) getSessionID() []byte {
+	return nil
+}
+
+func (p *controlProxyTransport) waitSession() error {
+	return nil
+}
+
+func controlProxyWritePacket(w io.Writer, f cryptobyte.BuilderContinuation) error {
+	var buf []byte
+	b := cryptobyte.NewBuilder(buf)
+	b.AddUint32LengthPrefixed(f)
+	out, err := b.Bytes()
+	if err != nil {
+		return err
+	}
+	_, err = w.Write(out)
+	return err
+}
+
+func controlProxyReadPacket(r io.Reader) (cryptobyte.String, error) {
+	var l uint32
+	if err := binary.Read(r, binary.BigEndian, &l); err != nil {
+		return nil, err
+	}
+	if l > maxPacket {
+		return nil, fmt.Errorf("message length %v exceeds maximum %v", l, maxPacket)
+	}
+	buf := make([]byte, l)
+	if _, err := io.ReadFull(r, buf); err != nil {
+		return nil, err
+	}
+	return buf, nil
+}
+
+func controlProxyReadMessage(r io.Reader) (messageType uint32, body cryptobyte.String, err error) {
+	body, err = controlProxyReadPacket(r)
+	if err != nil {
+		return 0, nil, fmt.Errorf("error reading message body: %w", err)
+	}
+	if !body.ReadUint32(&messageType) {
+		return 0, nil, errors.New("EOF reading message type")
+	}
+	return messageType, body, nil
+}
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/crypto/ssh/handshake.go /work/src/external-provisioner/vendor/golang.org/x/crypto/ssh/handshake.go
--- a/vendor/golang.org/x/crypto/ssh/handshake.go	2026-09-05 00:02:32.150804738 +0000
+++ b/vendor/golang.org/x/crypto/ssh/handshake.go	2026-09-05 00:03:04.406979558 +0000
@@ -162,7 +162,7 @@
 	t.remoteAddr = addr
 	t.hostKeyCallback = config.HostKeyCallback
 	t.bannerCallback = config.BannerCallback
-	if config.HostKeyAlgorithms != nil {
+	if len(config.HostKeyAlgorithms) > 0 {
 		t.hostKeyAlgorithms = config.HostKeyAlgorithms
 	} else {
 		t.hostKeyAlgorithms = defaultHostKeyAlgos
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/crypto/ssh/kex.go /work/src/external-provisioner/vendor/golang.org/x/crypto/ssh/kex.go
--- a/vendor/golang.org/x/crypto/ssh/kex.go	2026-09-05 00:02:32.150804738 +0000
+++ b/vendor/golang.org/x/crypto/ssh/kex.go	2026-09-05 00:03:04.406979558 +0000
@@ -16,6 +16,7 @@
 	"io"
 	"math/big"
 	"slices"
+	"sync"
 
 	"golang.org/x/crypto/curve25519"
 )
@@ -718,15 +719,9 @@
 			kexDHGexRequest.MaxBits, kexDHGexRequest.PreferredBits)
 	}
 
-	var p *big.Int
-	// We hardcode sending Oakley Group 14 (2048 bits), Oakley Group 15 (3072
-	// bits) or Oakley Group 16 (4096 bits), based on the requested max size.
-	if kexDHGexRequest.MaxBits < 3072 {
-		p, _ = new(big.Int).SetString(oakleyGroup14, 16)
-	} else if kexDHGexRequest.MaxBits < 4096 {
-		p, _ = new(big.Int).SetString(oakleyGroup15, 16)
-	} else {
-		p, _ = new(big.Int).SetString(oakleyGroup16, 16)
+	p, err := chooseDH(kexDHGexRequest)
+	if err != nil {
+		return nil, err
 	}
 
 	g := big.NewInt(2)
@@ -805,3 +800,65 @@
 		Hash:      gex.hashFunc,
 	}, err
 }
+
+type dhKEXGroup struct {
+	size int
+	p    *big.Int
+}
+
+// supportedDHKEXGroups returns the DH groups the server is willing to offer
+// for diffie-hellman-group-exchange-* key exchanges. The list is built lazily
+// on first use to keep the hex-to-big.Int parse out of package initialization.
+var supportedDHKEXGroups = sync.OnceValue(func() []dhKEXGroup {
+	specs := []struct {
+		size int
+		hex  string
+	}{
+		{2048, oakleyGroup14},
+		{3072, oakleyGroup15},
+		{4096, oakleyGroup16},
+	}
+	out := make([]dhKEXGroup, 0, len(specs))
+	for _, s := range specs {
+		p, _ := new(big.Int).SetString(s.hex, 16)
+		out = append(out, dhKEXGroup{size: s.size, p: p})
+	}
+	return out
+})
+
+// chooseDH picks a DH group for the given client request, mirroring the
+// algorithm used by OpenSSH's choose_dh in dh.c: prefer the smallest known
+// group larger than  or equal to the client's PreferredBits, and otherwise pick
+// the largest group within the accepted [MinBits, MaxBits] range.
+func chooseDH(req kexDHGexRequestMsg) (*big.Int, error) {
+	var best *big.Int
+	bestSize := 0
+	wantBits := int(req.PreferredBits)
+
+	for _, group := range supportedDHKEXGroups() {
+		if uint32(group.size) < req.MinBits || uint32(group.size) > req.MaxBits {
+			continue
+		}
+
+		if bestSize == 0 {
+			best = group.p
+			bestSize = group.size
+			continue
+		}
+
+		closerFromAbove := group.size >= wantBits && group.size < bestSize
+		closerFromBelow := group.size > bestSize && bestSize < wantBits
+
+		if closerFromAbove || closerFromBelow {
+			best = group.p
+			bestSize = group.size
+		}
+	}
+
+	if bestSize == 0 {
+		return nil, fmt.Errorf("ssh: no suitable DH group found for request min: %d, preferred: %d, max: %d",
+			req.MinBits, req.PreferredBits, req.MaxBits)
+	}
+
+	return best, nil
+}
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/crypto/ssh/keys.go /work/src/external-provisioner/vendor/golang.org/x/crypto/ssh/keys.go
--- a/vendor/golang.org/x/crypto/ssh/keys.go	2026-09-05 00:02:32.150804738 +0000
+++ b/vendor/golang.org/x/crypto/ssh/keys.go	2026-09-05 00:03:04.406979558 +0000
@@ -76,7 +76,7 @@
 	case InsecureKeyAlgoDSA:
 		return parseDSA(in)
 	case KeyAlgoECDSA256, KeyAlgoECDSA384, KeyAlgoECDSA521:
-		return parseECDSA(in)
+		return parseECDSA(in, algo)
 	case KeyAlgoSKECDSA256:
 		return parseSKECDSA(in)
 	case KeyAlgoED25519:
@@ -182,14 +182,19 @@
 		}
 
 		hosts := string(keyFields[0])
-		// keyFields[1] contains the key type (e.g. “ssh-rsa”).
-		// However, that information is duplicated inside the
-		// base64-encoded key and so is ignored here.
+		// keyFields[1] contains the key type (e.g. "ssh-rsa"). This information
+		// is duplicated within the base64-encoded key blob. As OpenSSH's
+		// sshkey_read does, we verify that the declared key type matches the
+		// type embedded in the key blob.
+		wantType := string(keyFields[1])
 
 		key := bytes.Join(keyFields[2:], []byte(" "))
 		if pubKey, comment, err = parseAuthorizedKey(key); err != nil {
 			return "", nil, nil, "", nil, err
 		}
+		if pubKey.Type() != wantType {
+			return "", nil, nil, "", nil, fmt.Errorf("ssh: known hosts key type mismatch: human-readable type %q, encoded type %q", wantType, pubKey.Type())
+		}
 
 		return marker, strings.Split(hosts, ","), pubKey, comment, rest, nil
 	}
@@ -228,10 +233,17 @@
 		}
 
 		if out, comment, err = parseAuthorizedKey(in[i:]); err == nil {
-			return out, comment, options, rest, nil
-		} else {
-			lastErr = err
+			// The first field contains the declared key type. As OpenSSH's
+			// sshkey_read does, we verify that it matches the type embedded in
+			// the key blob. Without this check, a single-token option (e.g.
+			// "restrict") appearing in the key type position could be silently
+			// discarded along with its intended effect.
+			if string(in[:i]) == out.Type() {
+				return out, comment, options, rest, nil
+			}
+			err = fmt.Errorf("ssh: authorized keys key type mismatch: human-readable type %q, encoded type %q", in[:i], out.Type())
 		}
+		lastErr = err
 
 		// No key type recognised. Maybe there's an options field at
 		// the beginning.
@@ -271,11 +283,15 @@
 		}
 
 		if out, comment, err = parseAuthorizedKey(in[i:]); err == nil {
-			options = candidateOptions
-			return out, comment, options, rest, nil
-		} else {
-			lastErr = err
+			// As above, the declared key type (here following the options
+			// field) must match the type embedded in the key blob.
+			if string(in[:i]) == out.Type() {
+				options = candidateOptions
+				return out, comment, options, rest, nil
+			}
+			err = fmt.Errorf("ssh: authorized keys key type mismatch: human-readable type %q, encoded type %q", in[:i], out.Type())
 		}
+		lastErr = err
 
 		in = rest
 		continue
@@ -469,10 +485,11 @@
 		return nil, nil, err
 	}
 
-	// 8192 bits is also the maximum RSA key size accepted by crypto/tls for
-	// signature verification:
-	// https://github.com/golang/go/blob/69801b25/src/crypto/tls/handshake_client.go#L1096
-	if w.N.BitLen() > 8192 {
+	// 16384 bits is the largest RSA key OpenSSH will generate (ssh-keygen
+	// caps -b at 16384), so it is the practical upper bound for keys seen on
+	// the wire. Rejecting anything larger bounds the CPU spent verifying an
+	// attacker-supplied key and signature, mitigating a denial of service.
+	if w.N.BitLen() > 16384 {
 		return nil, nil, errors.New("ssh: rsa modulus too large")
 	}
 	if w.E.BitLen() > 24 {
@@ -806,7 +823,7 @@
 }
 
 // parseECDSA parses an ECDSA key according to RFC 5656, section 3.1.
-func parseECDSA(in []byte) (out PublicKey, rest []byte, err error) {
+func parseECDSA(in []byte, expectedType string) (out PublicKey, rest []byte, err error) {
 	var w struct {
 		Curve    string
 		KeyBytes []byte
@@ -817,6 +834,12 @@
 		return nil, nil, err
 	}
 
+	actualType := "ecdsa-sha2-" + w.Curve
+	if expectedType != actualType {
+		return nil, nil, fmt.Errorf("ssh: algorithm type mismatch: expected %q, found curve %q (type %q)",
+			expectedType, w.Curve, actualType)
+	}
+
 	key := new(ecdsa.PublicKey)
 
 	switch w.Curve {
@@ -1466,6 +1489,17 @@
 			return nil, err
 		}
 
+		// OpenSSH does not impose an upper bound on the bcrypt round count
+		// stored in the key file, but bcrypt_pbkdf cost is linear in rounds:
+		// the default is 16, ssh-keygen lets users pick anything up to
+		// INT_MAX. Cap at 2048 (128x the default, a few seconds of CPU) so
+		// that an oversized value in the file cannot tie up the caller for
+		// months.
+		const maxRounds = 1 << 11
+		if opts.Rounds > maxRounds {
+			return nil, fmt.Errorf("ssh: bcrypt KDF rounds %d exceed maximum %d", opts.Rounds, maxRounds)
+		}
+
 		k, err := bcrypt_pbkdf.Key(passphrase, []byte(opts.Salt), int(opts.Rounds), 32+16)
 		if err != nil {
 			return nil, err
@@ -1635,10 +1669,28 @@
 			return nil, err
 		}
 
+		// Mirror the validation done in parseRSA for public keys: cap the
+		// modulus at the OpenSSH-generated maximum, reject oversized or
+		// invalid exponents, and additionally bound the prime factors to
+		// avoid the expensive CRT coefficient recomputation in pk.Precompute.
+		if key.N.BitLen() > 16384 {
+			return nil, errors.New("ssh: rsa modulus too large")
+		}
+		if key.P.BitLen() > 8192 || key.Q.BitLen() > 8192 {
+			return nil, errors.New("ssh: rsa prime too large")
+		}
+		if key.E.BitLen() > 24 {
+			return nil, errors.New("ssh: exponent too large")
+		}
+		e := key.E.Int64()
+		if e < 3 || e&1 == 0 {
+			return nil, errors.New("ssh: incorrect exponent")
+		}
+
 		pk := &rsa.PrivateKey{
 			PublicKey: rsa.PublicKey{
 				N: key.N,
-				E: int(key.E.Int64()),
+				E: int(e),
 			},
 			D:      key.D,
 			Primes: []*big.Int{key.P, key.Q},
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/crypto/ssh/messages.go /work/src/external-provisioner/vendor/golang.org/x/crypto/ssh/messages.go
--- a/vendor/golang.org/x/crypto/ssh/messages.go	2026-09-05 00:02:32.150804738 +0000
+++ b/vendor/golang.org/x/crypto/ssh/messages.go	2026-09-05 00:03:04.406979558 +0000
@@ -44,7 +44,7 @@
 }
 
 func (d *disconnectMsg) Error() string {
-	return fmt.Sprintf("ssh: disconnect, reason %d: %s", d.Reason, d.Message)
+	return fmt.Sprintf("ssh: disconnect, reason %d: %q", d.Reason, d.Message)
 }
 
 // See RFC 4253, section 7.1.
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/crypto/ssh/mux.go /work/src/external-provisioner/vendor/golang.org/x/crypto/ssh/mux.go
--- a/vendor/golang.org/x/crypto/ssh/mux.go	2026-09-05 00:02:32.150804738 +0000
+++ b/vendor/golang.org/x/crypto/ssh/mux.go	2026-09-05 00:03:04.406979558 +0000
@@ -32,18 +32,21 @@
 	offset uint32
 }
 
-// Assigns a channel ID to the given channel.
-func (c *chanList) add(ch *channel) uint32 {
+// add stores the given channel and assigns its localId while holding the
+// lock, so that getChan can never return a channel whose localId is not yet
+// initialized.
+func (c *chanList) add(ch *channel) {
 	c.Lock()
 	defer c.Unlock()
 	for i := range c.chans {
 		if c.chans[i] == nil {
 			c.chans[i] = ch
-			return uint32(i) + c.offset
+			ch.localId = uint32(i) + c.offset
+			return
 		}
 	}
 	c.chans = append(c.chans, ch)
-	return uint32(len(c.chans)-1) + c.offset
+	ch.localId = uint32(len(c.chans)-1) + c.offset
 }
 
 // getChan returns the channel for the given ID.
@@ -155,7 +158,10 @@
 	drain:
 		for {
 			select {
-			case <-m.globalResponses:
+			case _, ok := <-m.globalResponses:
+				if !ok {
+					break drain
+				}
 			default:
 				break drain
 			}
@@ -340,8 +346,6 @@
 func (m *mux) openChannel(chanType string, extra []byte) (*channel, error) {
 	ch := m.newChannel(chanType, channelOutbound, extra)
 
-	ch.maxIncomingPayload = channelMaxPacket
-
 	open := channelOpenMsg{
 		ChanType:         chanType,
 		PeersWindow:      ch.myWindow,
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/crypto/ssh/server.go /work/src/external-provisioner/vendor/golang.org/x/crypto/ssh/server.go
--- a/vendor/golang.org/x/crypto/ssh/server.go	2026-09-05 00:02:32.150804738 +0000
+++ b/vendor/golang.org/x/crypto/ssh/server.go	2026-09-05 00:03:04.406979558 +0000
@@ -26,10 +26,16 @@
 	// defines "force-command" (only allow the given command to
 	// execute) and "source-address" (only allow connections from
 	// the given address). The SSH package currently only enforces
-	// the "source-address" critical option. It is up to server
-	// implementations to enforce other critical options, such as
-	// "force-command", by checking them after the SSH handshake
-	// is successful. In general, SSH servers should reject
+	// the "source-address" critical option: it is validated against
+	// the client's remote address whenever it is present in the
+	// Permissions returned by any authentication callback. Its value
+	// is a comma-separated list of IP addresses and CIDR blocks;
+	// consistently with OpenSSH, a connection whose remote address is
+	// not an IP address, such as a Unix domain socket, never matches
+	// the list and is rejected when the option is present. It is up
+	// to server implementations to enforce other critical options,
+	// such as "force-command", by checking them after the SSH
+	// handshake is successful. In general, SSH servers should reject
 	// connections that specify critical options that are unknown
 	// or not supported.
 	CriticalOptions map[string]string
@@ -54,6 +60,9 @@
 	ExtraData map[any]any
 }
 
+// GSSAPIWithMICConfig includes the server callbacks for gssapi-with-mic
+// authentication. If either field is nil, gssapi-with-mic is considered not
+// configured.
 type GSSAPIWithMICConfig struct {
 	// AllowLogin, must be set, is called when gssapi-with-mic
 	// authentication is selected (RFC 4462 section 3). The srcName is from the
@@ -68,6 +77,10 @@
 	Server GSSAPIServer
 }
 
+func gssapiWithMICConfigured(config *GSSAPIWithMICConfig) bool {
+	return config != nil && config.AllowLogin != nil && config.Server != nil
+}
+
 // SendAuthBanner implements [ServerPreAuthConn].
 func (s *connection) SendAuthBanner(msg string) error {
 	return s.transport.writePacket(Marshal(&userAuthBannerMsg{
@@ -216,7 +229,9 @@
 	// Permissions object can be the same object, optionally modified, or a
 	// completely new object. If VerifiedPublicKeyCallback is non-nil,
 	// PublicKeyCallback is not allowed to return a PartialSuccessError, which
-	// can instead be returned by VerifiedPublicKeyCallback.
+	// can instead be returned by VerifiedPublicKeyCallback. The
+	// signatureAlgorithm argument is the format of the signature that was
+	// successfully verified.
 	//
 	// VerifiedPublicKeyCallback does not affect which authentication methods
 	// are included in the list of methods that can be attempted by the client.
@@ -382,8 +397,7 @@
 	}
 
 	if !config.NoClientAuth && config.PasswordCallback == nil && config.PublicKeyCallback == nil &&
-		config.KeyboardInteractiveCallback == nil && (config.GSSAPIWithMICConfig == nil ||
-		config.GSSAPIWithMICConfig.AllowLogin == nil || config.GSSAPIWithMICConfig.Server == nil) {
+		config.KeyboardInteractiveCallback == nil && !gssapiWithMICConfigured(config.GSSAPIWithMICConfig) {
 		return nil, errors.New("ssh: no authentication methods configured but NoClientAuth is also false")
 	}
 
@@ -436,6 +450,10 @@
 	return perms, err
 }
 
+// checkSourceAddress matches addr against sourceAddrs, a comma-separated list
+// of IP addresses and CIDR blocks. Consistently with OpenSSH, a remote address
+// that is not IP-based, such as a Unix domain socket, never matches the list
+// and is rejected.
 func checkSourceAddress(addr net.Addr, sourceAddrs string) error {
 	if addr == nil {
 		return errors.New("ssh: no address known for client, but source-address match required")
@@ -443,7 +461,7 @@
 
 	tcpAddr, ok := addr.(*net.TCPAddr)
 	if !ok {
-		return fmt.Errorf("ssh: remote address %v is not an TCP address when checking source-address match", addr)
+		return fmt.Errorf("ssh: remote address %v is not a TCP address when checking source-address match", addr)
 	}
 
 	for _, sourceAddr := range strings.Split(sourceAddrs, ",") {
@@ -466,6 +484,21 @@
 	return fmt.Errorf("ssh: remote address %v is not allowed because of source-address restriction", addr)
 }
 
+// checkSourceAddressCriticalOption enforces the source-address critical
+// option, if present in perms, as documented in Permissions.CriticalOptions.
+// A present but empty value matches no address, so it denies authentication,
+// consistently with OpenSSH, rather than being treated as absent.
+func checkSourceAddressCriticalOption(addr net.Addr, perms *Permissions) error {
+	if perms == nil {
+		return nil
+	}
+	saco, ok := perms.CriticalOptions[sourceAddressCriticalOption]
+	if !ok {
+		return nil
+	}
+	return checkSourceAddress(addr, saco)
+}
+
 func gssExchangeToken(gssapiConfig *GSSAPIWithMICConfig, token []byte, s *connection,
 	sessionID []byte, userAuthReq userAuthRequestMsg) (authErr error, perms *Permissions, err error) {
 	gssAPIServer := gssapiConfig.Server
@@ -607,6 +640,15 @@
 	return b.Err.Error()
 }
 
+// maxAuthServerAttempts caps the total number of SSH_MSG_USERAUTH_REQUEST
+// messages the server will process on a single connection, regardless of
+// outcome (failure, partial success, public key query, or none). It is a
+// backstop against clients that drive the authentication loop indefinitely
+// without ever incurring a real failure — for example by repeatedly
+// triggering PartialSuccessError or by spamming public key offer queries —
+// neither of which increment the MaxAuthTries failure counter.
+const maxAuthServerAttempts = 128
+
 func (s *connection) serverAuthenticate(config *ServerConfig) (*Permissions, error) {
 	if config.PreAuthConnCallback != nil {
 		config.PreAuthConnCallback(s)
@@ -617,6 +659,7 @@
 	var perms *Permissions
 
 	authFailures := 0
+	authAttempts := 0
 	noneAuthCount := 0
 	var authErrs []error
 	var calledBannerCallback bool
@@ -645,6 +688,19 @@
 			return nil, &ServerAuthError{Errors: authErrs}
 		}
 
+		if authAttempts >= maxAuthServerAttempts {
+			discMsg := &disconnectMsg{
+				Reason:  2,
+				Message: "too many authentication attempts",
+			}
+			if err := s.transport.writePacket(Marshal(discMsg)); err != nil {
+				return nil, err
+			}
+			authErrs = append(authErrs, discMsg)
+			return nil, &ServerAuthError{Errors: authErrs}
+		}
+		authAttempts++
+
 		var userAuthReq userAuthRequestMsg
 		if packet, err := s.transport.readPacket(); err != nil {
 			if err == io.EOF {
@@ -656,7 +712,7 @@
 		}
 
 		if userAuthReq.Service != serviceSSH {
-			return nil, errors.New("ssh: client attempted to negotiate for unknown service: " + userAuthReq.Service)
+			return nil, fmt.Errorf("ssh: client attempted to negotiate for unknown service: %q", userAuthReq.Service)
 		}
 
 		if s.user != userAuthReq.User && partialSuccessReturned {
@@ -742,7 +798,8 @@
 
 			pubKey, err := ParsePublicKey(pubKeyData)
 			if err != nil {
-				return nil, err
+				authErr = err
+				break
 			}
 
 			candidate, ok := cache.get(s.user, pubKeyData)
@@ -755,13 +812,14 @@
 					return nil, errors.New("ssh: invalid library usage: PublicKeyCallback must not return partial success when VerifiedPublicKeyCallback is defined")
 				}
 
-				if (candidate.result == nil || isPartialSuccessError) &&
-					candidate.perms != nil &&
-					candidate.perms.CriticalOptions != nil &&
-					candidate.perms.CriticalOptions[sourceAddressCriticalOption] != "" {
-					if err := checkSourceAddress(
-						s.RemoteAddr(),
-						candidate.perms.CriticalOptions[sourceAddressCriticalOption]); err != nil {
+				// This check is authoritative for the Permissions returned by
+				// PublicKeyCallback: the check at the end of the auth loop sees
+				// the final Permissions, which VerifiedPublicKeyCallback may
+				// have replaced, and is skipped on partial success. It also
+				// makes public key queries fail before the client signs when
+				// PublicKeyCallback supplies the restriction.
+				if candidate.result == nil || isPartialSuccessError {
+					if err := checkSourceAddressCriticalOption(s.RemoteAddr(), candidate.perms); err != nil {
 						candidate.result = err
 					}
 				}
@@ -835,18 +893,11 @@
 					// Only call VerifiedPublicKeyCallback after the key has been accepted
 					// and successfully verified. If authErr is non-nil, the key is not
 					// considered verified and the callback must not run.
-					perms, authErr = config.VerifiedPublicKeyCallback(s, pubKey, perms, algo)
-				}
-				if authErr == nil && perms != nil && perms.CriticalOptions != nil {
-					if saco := perms.CriticalOptions[sourceAddressCriticalOption]; saco != "" {
-						if err := checkSourceAddress(s.RemoteAddr(), saco); err != nil {
-							authErr = err
-						}
-					}
+					perms, authErr = config.VerifiedPublicKeyCallback(s, pubKey, perms, sig.Format)
 				}
 			}
 		case "gssapi-with-mic":
-			if authConfig.GSSAPIWithMICConfig == nil {
+			if !gssapiWithMICConfigured(authConfig.GSSAPIWithMICConfig) {
 				authErr = errors.New("ssh: gssapi-with-mic auth not configured")
 				break
 			}
@@ -896,6 +947,17 @@
 			authErr = fmt.Errorf("ssh: unknown method %q", userAuthReq.Method)
 		}
 
+		// The source-address critical option is enforced on the Permissions
+		// returned by any authentication callback. Permissions returned
+		// together with a PartialSuccessError skip this check: that is safe
+		// because they are required to be nil, as enforced in the partial
+		// success handling below.
+		if authErr == nil {
+			if err := checkSourceAddressCriticalOption(s.RemoteAddr(), perms); err != nil {
+				authErr = err
+			}
+		}
+
 		authErrs = append(authErrs, authErr)
 
 		if config.AuthLogCallback != nil {
@@ -979,8 +1041,7 @@
 		if authConfig.KeyboardInteractiveCallback != nil {
 			failureMsg.Methods = append(failureMsg.Methods, "keyboard-interactive")
 		}
-		if authConfig.GSSAPIWithMICConfig != nil && authConfig.GSSAPIWithMICConfig.Server != nil &&
-			authConfig.GSSAPIWithMICConfig.AllowLogin != nil {
+		if gssapiWithMICConfigured(authConfig.GSSAPIWithMICConfig) {
 			failureMsg.Methods = append(failureMsg.Methods, "gssapi-with-mic")
 		}
 
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/crypto/ssh/session.go /work/src/external-provisioner/vendor/golang.org/x/crypto/ssh/session.go
--- a/vendor/golang.org/x/crypto/ssh/session.go	2026-09-05 00:02:32.150804738 +0000
+++ b/vendor/golang.org/x/crypto/ssh/session.go	2026-09-05 00:03:04.406979558 +0000
@@ -423,6 +423,9 @@
 	for msg := range reqs {
 		switch msg.Type {
 		case "exit-status":
+			if len(msg.Payload) < 4 {
+				return errors.New("ssh: malformed exit-status request")
+			}
 			wm.status = int(binary.BigEndian.Uint32(msg.Payload))
 		case "exit-signal":
 			var sigval struct {
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/crypto/ssh/ssh_gss.go /work/src/external-provisioner/vendor/golang.org/x/crypto/ssh/ssh_gss.go
--- a/vendor/golang.org/x/crypto/ssh/ssh_gss.go	2026-09-05 00:02:32.150804738 +0000
+++ b/vendor/golang.org/x/crypto/ssh/ssh_gss.go	2026-09-05 00:03:04.406979558 +0000
@@ -118,24 +118,28 @@
 		OIDS: make([]asn1.ObjectIdentifier, n),
 	}
 	for i := 0; i < int(n); i++ {
-		var (
-			desiredMech []byte
-			err         error
-		)
+		var desiredMech []byte
 		desiredMech, rest, ok = parseString(rest)
 		if !ok {
 			return nil, errors.New("parse string failed")
 		}
-		if rest, err = asn1.Unmarshal(desiredMech, &s.OIDS[i]); err != nil {
+		trailing, err := asn1.Unmarshal(desiredMech, &s.OIDS[i])
+		if err != nil {
 			return nil, err
 		}
+		if len(trailing) != 0 {
+			return nil, errors.New("trailing bytes after OID")
+		}
+	}
+	if len(rest) != 0 {
+		return nil, errors.New("trailing bytes after mechanisms")
 	}
 	return s, nil
 }
 
 // See RFC 4462 section 3.6.
 func buildMIC(sessionID string, username string, service string, authMethod string) []byte {
-	out := make([]byte, 0, 0)
+	out := make([]byte, 0)
 	out = appendString(out, sessionID)
 	out = append(out, msgUserAuthRequest)
 	out = appendString(out, username)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/crypto/ssh/streamlocal.go /work/src/external-provisioner/vendor/golang.org/x/crypto/ssh/streamlocal.go
--- a/vendor/golang.org/x/crypto/ssh/streamlocal.go	2026-09-05 00:02:32.150804738 +0000
+++ b/vendor/golang.org/x/crypto/ssh/streamlocal.go	2026-09-05 00:03:04.406979558 +0000
@@ -58,6 +58,7 @@
 		return nil, err
 	}
 	go DiscardRequests(in)
+	go io.Copy(io.Discard, ch.Stderr())
 	return ch, err
 }
 
@@ -79,6 +80,7 @@
 		return nil, err
 	}
 	go DiscardRequests(incoming)
+	go io.Copy(io.Discard, ch.Stderr())
 
 	return &chanConn{
 		Channel: ch,
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/crypto/ssh/tcpip.go /work/src/external-provisioner/vendor/golang.org/x/crypto/ssh/tcpip.go
--- a/vendor/golang.org/x/crypto/ssh/tcpip.go	2026-09-05 00:02:32.150804738 +0000
+++ b/vendor/golang.org/x/crypto/ssh/tcpip.go	2026-09-05 00:03:04.406979558 +0000
@@ -332,6 +332,7 @@
 		return nil, err
 	}
 	go DiscardRequests(incoming)
+	go io.Copy(io.Discard, ch.Stderr())
 
 	return &chanConn{
 		Channel: ch,
@@ -495,6 +496,7 @@
 		return nil, err
 	}
 	go DiscardRequests(in)
+	go io.Copy(io.Discard, ch.Stderr())
 	return ch, nil
 }
 
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/crypto/ssh/transport.go /work/src/external-provisioner/vendor/golang.org/x/crypto/ssh/transport.go
--- a/vendor/golang.org/x/crypto/ssh/transport.go	2026-09-05 00:02:32.150804738 +0000
+++ b/vendor/golang.org/x/crypto/ssh/transport.go	2026-09-05 00:03:04.406979558 +0000
@@ -331,13 +331,19 @@
 // chars
 const maxVersionStringBytes = 255
 
+// maxPreVersionLines is the maximum number of lines sent by the peer
+// before the version string. Each of these lines is limited to a maximum
+// of maxVersionStringBytes chars. Lines sent before the version string
+// are silently ignored.
+const maxPreVersionLines = 1024
+
 // Read version string as specified by RFC 4253, section 4.2.
 func readVersion(r io.Reader) ([]byte, error) {
 	versionString := make([]byte, 0, 64)
 	var ok bool
 	var buf [1]byte
 
-	for length := 0; length < maxVersionStringBytes; length++ {
+	for lines := 0; len(versionString) < maxVersionStringBytes && lines < maxPreVersionLines; {
 		_, err := io.ReadFull(r, buf[:])
 		if err != nil {
 			return nil, err
@@ -347,9 +353,9 @@
 		if buf[0] == '\n' {
 			if !bytes.HasPrefix(versionString, []byte("SSH-")) {
 				// RFC 4253 says we need to ignore all version string lines
-				// except the one containing the SSH version (provided that
-				// all the lines do not exceed 255 bytes in total).
+				// except the one containing the SSH version.
 				versionString = versionString[:0]
+				lines++
 				continue
 			}
 			ok = true
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/net/html/entity.go /work/src/external-provisioner/vendor/golang.org/x/net/html/entity.go
--- a/vendor/golang.org/x/net/html/entity.go	2026-09-05 00:02:32.150804738 +0000
+++ b/vendor/golang.org/x/net/html/entity.go	2026-09-05 00:03:04.446979762 +0000
@@ -2156,9 +2156,8 @@
 
 // HTML entities that are two unicode codepoints.
 var entity2 = map[string][2]rune{
-	// TODO(nigeltao): Handle replacements that are wider than their names.
-	// "nLt;":                     {'\u226A', '\u20D2'},
-	// "nGt;":                     {'\u226B', '\u20D2'},
+	"nLt;":                     {'\u226A', '\u20D2'},
+	"nGt;":                     {'\u226B', '\u20D2'},
 	"NotEqualTilde;":           {'\u2242', '\u0338'},
 	"NotGreaterFullEqual;":     {'\u2267', '\u0338'},
 	"NotGreaterGreater;":       {'\u226B', '\u0338'},
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/net/html/escape.go /work/src/external-provisioner/vendor/golang.org/x/net/html/escape.go
--- a/vendor/golang.org/x/net/html/escape.go	2026-09-05 00:02:32.150804738 +0000
+++ b/vendor/golang.org/x/net/html/escape.go	2026-09-05 00:03:04.446979762 +0000
@@ -6,6 +6,7 @@
 
 import (
 	"bytes"
+	"slices"
 	"strings"
 	"unicode/utf8"
 )
@@ -50,25 +51,24 @@
 	// 0x0D->'\u000D' is a no-op.
 }
 
-// unescapeEntity reads an entity like "&lt;" from b[src:] and writes the
-// corresponding "<" to b[dst:], returning the incremented dst and src cursors.
-// Precondition: b[src] == '&' && dst <= src.
-// attribute should be true if parsing an attribute value.
-func unescapeEntity(b []byte, dst, src int, attribute bool) (dst1, src1 int) {
+// unescapeEntity attempts to consume a character reference from s[src:],
+// returning the rune, potential second rune, and number of bytes consumed
+// (which indicates the length of the character reference). It is assumed that
+// the first byte of s is '&'. attribute should be true if parsing an attribute
+// value.
+func unescapeEntity(s []byte, attribute bool) (rune, rune, int) {
 	// https://html.spec.whatwg.org/multipage/syntax.html#consume-a-character-reference
 
 	// i starts at 1 because we already know that s[0] == '&'.
-	i, s := 1, b[src:]
+	i := 1
 
 	if len(s) <= 1 {
-		b[dst] = b[src]
-		return dst + 1, src + 1
+		return '&', 0, 1
 	}
 
 	if s[i] == '#' {
-		if len(s) <= 3 { // We need to have at least "&#.".
-			b[dst] = b[src]
-			return dst + 1, src + 1
+		if len(s) <= 2 { // We need to have at least "&#".
+			return '&', 0, 1
 		}
 		i++
 		c := s[i]
@@ -78,34 +78,43 @@
 			i++
 		}
 
+		i0 := i
 		x := '\x00'
 		for i < len(s) {
 			c = s[i]
-			i++
+			var d rune
+			var mult rune
 			if hex {
+				mult = 16
 				if '0' <= c && c <= '9' {
-					x = 16*x + rune(c) - '0'
-					continue
+					d = rune(c) - '0'
 				} else if 'a' <= c && c <= 'f' {
-					x = 16*x + rune(c) - 'a' + 10
-					continue
+					d = rune(c) - 'a' + 10
 				} else if 'A' <= c && c <= 'F' {
-					x = 16*x + rune(c) - 'A' + 10
-					continue
+					d = rune(c) - 'A' + 10
+				} else {
+					break
+				}
+			} else {
+				mult = 10
+				if '0' <= c && c <= '9' {
+					d = rune(c) - '0'
+				} else {
+					break
 				}
-			} else if '0' <= c && c <= '9' {
-				x = 10*x + rune(c) - '0'
-				continue
 			}
-			if c != ';' {
-				i--
+			if x <= 0x10FFFF {
+				x = mult*x + d
 			}
-			break
+			i++
 		}
 
-		if i <= 3 { // No characters matched.
-			b[dst] = b[src]
-			return dst + 1, src + 1
+		if i == i0 { // No characters matched.
+			return '&', 0, 1
+		}
+
+		if i < len(s) && s[i] == ';' {
+			i++
 		}
 
 		if 0x80 <= x && x <= 0x9F {
@@ -116,7 +125,7 @@
 			x = '\uFFFD'
 		}
 
-		return dst + utf8.EncodeRune(b[dst:], x), src + i
+		return x, 0, i
 	}
 
 	// Consume the maximum number of characters possible, with the
@@ -141,10 +150,9 @@
 	} else if attribute && entityName[len(entityName)-1] != ';' && len(s) > i && s[i] == '=' {
 		// No-op.
 	} else if x := entity[entityName]; x != 0 {
-		return dst + utf8.EncodeRune(b[dst:], x), src + i
+		return x, 0, i
 	} else if x := entity2[entityName]; x[0] != 0 {
-		dst1 := dst + utf8.EncodeRune(b[dst:], x[0])
-		return dst1 + utf8.EncodeRune(b[dst1:], x[1]), src + i
+		return x[0], x[1], i
 	} else if !attribute {
 		maxLen := len(entityName) - 1
 		if maxLen > longestEntityWithoutSemicolon {
@@ -152,35 +160,67 @@
 		}
 		for j := maxLen; j > 1; j-- {
 			if x := entity[entityName[:j]]; x != 0 {
-				return dst + utf8.EncodeRune(b[dst:], x), src + j + 1
+				return x, 0, j + 1
 			}
 		}
 	}
 
-	dst1, src1 = dst+i, src+i
-	copy(b[dst:dst1], b[src:src1])
-	return dst1, src1
+	return '&', 0, 1
 }
 
-// unescape unescapes b's entities in-place, so that "a&lt;b" becomes "a<b".
-// attribute should be true if parsing an attribute value.
+// unescape unescapes b's entites, so that "a&lt;b" becomes "a<b". It attempts
+// to do so in place, but if the unescaped value is longer than the input it
+// allocates a new slice. attribute should be true if parsing an attribute
+// value.
 func unescape(b []byte, attribute bool) []byte {
-	for i, c := range b {
-		if c == '&' {
-			dst, src := unescapeEntity(b, i, i, attribute)
-			for src < len(b) {
-				c := b[src]
-				if c == '&' {
-					dst, src = unescapeEntity(b, dst, src, attribute)
-				} else {
-					b[dst] = c
-					dst, src = dst+1, src+1
-				}
+	firstAmp := slices.Index(b, '&')
+	if firstAmp == -1 {
+		return b
+	}
+
+	out := b[:firstAmp]
+	src := firstAmp
+	reusingB := true
+	for src < len(b) {
+		if b[src] != '&' {
+			out = append(out, b[src])
+			src++
+			continue
+		}
+
+		r1, r2, entityNameLen := unescapeEntity(b[src:], attribute)
+		if entityNameLen == 1 && r1 == '&' {
+			// Not an entity
+			out = append(out, '&')
+			src++
+			continue
+		}
+
+		// Compute replacement length
+		replLen := utf8.RuneLen(r1)
+		if r2 != 0 {
+			replLen += utf8.RuneLen(r2)
+		}
+
+		// If the name of the entity is shorter than the width of the
+		// replacement runes then we need to expand the output slice to
+		// fit the replacement.
+		if replLen > entityNameLen {
+			if reusingB {
+				out = slices.Clone(out)
+				reusingB = false
 			}
-			return b[0:dst]
+			out = slices.Grow(out, replLen)
 		}
+		out = utf8.AppendRune(out, r1)
+		if r2 != 0 {
+			out = utf8.AppendRune(out, r2)
+		}
+
+		src += entityNameLen
 	}
-	return b
+
+	return out
 }
 
 // lower lower-cases the A-Z bytes in b in-place, so that "aBc" becomes "abc".
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/net/html/foreign.go /work/src/external-provisioner/vendor/golang.org/x/net/html/foreign.go
--- a/vendor/golang.org/x/net/html/foreign.go	2026-09-05 00:02:32.150804738 +0000
+++ b/vendor/golang.org/x/net/html/foreign.go	2026-09-05 00:03:04.446979762 +0000
@@ -23,7 +23,7 @@
 		}
 		switch a.Key {
 		case "xlink:actuate", "xlink:arcrole", "xlink:href", "xlink:role", "xlink:show",
-			"xlink:title", "xlink:type", "xml:base", "xml:lang", "xml:space", "xmlns:xlink":
+			"xlink:title", "xlink:type", "xml:lang", "xml:space", "xmlns:xlink":
 			j := strings.Index(a.Key, ":")
 			aa[i].Namespace = a.Key[:j]
 			aa[i].Key = a.Key[j+1:]
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/net/html/parse.go /work/src/external-provisioner/vendor/golang.org/x/net/html/parse.go
--- a/vendor/golang.org/x/net/html/parse.go	2026-09-05 00:02:32.150804738 +0000
+++ b/vendor/golang.org/x/net/html/parse.go	2026-09-05 00:03:04.446979762 +0000
@@ -63,7 +63,7 @@
 // Stop tags for use in popUntil. These come from section 12.2.4.2.
 var (
 	defaultScopeStopTags = map[string][]a.Atom{
-		"":     {a.Applet, a.Caption, a.Html, a.Table, a.Td, a.Th, a.Marquee, a.Object, a.Template},
+		"":     {a.Applet, a.Caption, a.Html, a.Table, a.Td, a.Th, a.Marquee, a.Object, a.Template, a.Select},
 		"math": {a.AnnotationXml, a.Mi, a.Mn, a.Mo, a.Ms, a.Mtext},
 		"svg":  {a.Desc, a.ForeignObject, a.Title},
 	}
@@ -78,7 +78,6 @@
 	tableScope
 	tableRowScope
 	tableBodyScope
-	selectScope
 )
 
 // popUntil pops the stack of open elements at the highest element whose tag
@@ -133,10 +132,6 @@
 				if tagAtom == a.Html || tagAtom == a.Table || tagAtom == a.Template {
 					return -1
 				}
-			case selectScope:
-				if tagAtom != a.Optgroup && tagAtom != a.Option {
-					return -1
-				}
 			default:
 				panic(fmt.Sprintf("html: internal error: indexOfElementInScope unknown scope: %d", s))
 			}
@@ -460,21 +455,6 @@
 		}
 
 		switch n.DataAtom {
-		case a.Select:
-			if !last {
-				for ancestor, first := n, p.oe[0]; ancestor != first; {
-					ancestor = p.oe[p.oe.index(ancestor)-1]
-					switch ancestor.DataAtom {
-					case a.Template:
-						p.im = inSelectIM
-						return
-					case a.Table:
-						p.im = inSelectInTableIM
-						return
-					}
-				}
-			}
-			p.im = inSelectIM
 		case a.Td, a.Th:
 			// TODO: remove this divergence from the HTML5 spec.
 			//
@@ -1002,7 +982,10 @@
 			p.popUntil(buttonScope, a.P)
 			p.addElement()
 		case a.Button:
-			p.popUntil(defaultScope, a.Button)
+			if p.elementInScope(defaultScope, a.Button) {
+				p.generateImpliedEndTags()
+				p.popUntil(defaultScope, a.Button)
+			}
 			p.reconstructActiveFormattingElements()
 			p.addElement()
 			p.framesetOK = false
@@ -1040,7 +1023,18 @@
 			p.framesetOK = false
 			p.im = inTableIM
 			return true
-		case a.Area, a.Br, a.Embed, a.Img, a.Input, a.Keygen, a.Wbr:
+		case a.Area, a.Br, a.Embed, a.Img, a.Keygen, a.Wbr:
+			p.reconstructActiveFormattingElements()
+			p.addElement()
+			p.oe.pop()
+			p.acknowledgeSelfClosingTag()
+			p.framesetOK = false
+		case a.Input:
+			if p.fragment && p.context.DataAtom == a.Select {
+				// Ignore the token.
+				return true
+			}
+			p.popUntil(defaultScope, a.Select)
 			p.reconstructActiveFormattingElements()
 			p.addElement()
 			p.oe.pop()
@@ -1061,7 +1055,13 @@
 			p.oe.pop()
 			p.acknowledgeSelfClosingTag()
 		case a.Hr:
-			p.popUntil(buttonScope, a.P)
+			if p.elementInScope(buttonScope, a.P) {
+				p.generateImpliedEndTags("p")
+				p.popUntil(defaultScope, a.P)
+			}
+			if p.elementInScope(defaultScope, a.Select) {
+				p.generateImpliedEndTags()
+			}
 			p.addElement()
 			p.oe.pop()
 			p.acknowledgeSelfClosingTag()
@@ -1095,13 +1095,30 @@
 			// Don't let the tokenizer go into raw text mode when scripting is disabled.
 			p.tokenizer.NextIsNotRawText()
 		case a.Select:
+			if p.fragment && p.context.DataAtom == a.Select {
+				// Ignore the token.
+				return true
+			} else if p.popUntil(defaultScope, a.Select) {
+				return true
+			}
 			p.reconstructActiveFormattingElements()
 			p.addElement()
 			p.framesetOK = false
-			p.im = inSelectIM
 			return true
-		case a.Optgroup, a.Option:
-			if p.top().DataAtom == a.Option {
+		case a.Option:
+			if p.elementInScope(defaultScope, a.Select) {
+				p.generateImpliedEndTags("optgroup")
+				// If oe has option element in scope, parse error?
+			} else if p.top().DataAtom == a.Option {
+				p.oe.pop()
+			}
+			p.reconstructActiveFormattingElements()
+			p.addElement()
+		case a.Optgroup:
+			if p.elementInScope(defaultScope, a.Select) {
+				p.generateImpliedEndTags()
+				// If oe has option or optgroup element in scope, parse error?
+			} else if p.top().DataAtom == a.Option {
 				p.oe.pop()
 			}
 			p.reconstructActiveFormattingElements()
@@ -1149,7 +1166,12 @@
 				return false
 			}
 			return true
-		case a.Address, a.Article, a.Aside, a.Blockquote, a.Button, a.Center, a.Details, a.Dialog, a.Dir, a.Div, a.Dl, a.Fieldset, a.Figcaption, a.Figure, a.Footer, a.Header, a.Hgroup, a.Listing, a.Main, a.Menu, a.Nav, a.Ol, a.Pre, a.Search, a.Section, a.Summary, a.Ul:
+		case a.Address, a.Article, a.Aside, a.Blockquote, a.Button, a.Center, a.Details, a.Dialog, a.Dir, a.Div, a.Dl, a.Fieldset, a.Figcaption, a.Figure, a.Footer, a.Header, a.Hgroup, a.Listing, a.Main, a.Menu, a.Nav, a.Ol, a.Pre, a.Search, a.Section, a.Select, a.Summary, a.Ul:
+			if !p.elementInScope(defaultScope, p.tok.DataAtom) {
+				// Ignore the token.
+				return true
+			}
+			p.generateImpliedEndTags()
 			p.popUntil(defaultScope, p.tok.DataAtom)
 		case a.Form:
 			if p.oe.contains(a.Template) {
@@ -1488,17 +1510,6 @@
 			}
 			p.addElement()
 			p.form = p.oe.pop()
-		case a.Select:
-			p.reconstructActiveFormattingElements()
-			switch p.top().DataAtom {
-			case a.Table, a.Tbody, a.Tfoot, a.Thead, a.Tr:
-				p.fosterParenting = true
-			}
-			p.addElement()
-			p.fosterParenting = false
-			p.framesetOK = false
-			p.im = inSelectInTableIM
-			return true
 		}
 	case EndTagToken:
 		switch p.tok.DataAtom {
@@ -1547,12 +1558,6 @@
 			p.clearActiveFormattingElements()
 			p.im = inTableIM
 			return false
-		case a.Select:
-			p.reconstructActiveFormattingElements()
-			p.addElement()
-			p.framesetOK = false
-			p.im = inSelectInTableIM
-			return true
 		}
 	case EndTagToken:
 		switch p.tok.DataAtom {
@@ -1762,12 +1767,6 @@
 			}
 			// Ignore the token.
 			return true
-		case a.Select:
-			p.reconstructActiveFormattingElements()
-			p.addElement()
-			p.framesetOK = false
-			p.im = inSelectInTableIM
-			return true
 		}
 	case EndTagToken:
 		switch p.tok.DataAtom {
@@ -1798,118 +1797,6 @@
 	return inBodyIM(p)
 }
 
-// Section 12.2.6.4.16.
-func inSelectIM(p *parser) bool {
-	switch p.tok.Type {
-	case TextToken:
-		p.addText(strings.Replace(p.tok.Data, "\x00", "", -1))
-	case StartTagToken:
-		switch p.tok.DataAtom {
-		case a.Html:
-			return inBodyIM(p)
-		case a.Option:
-			if p.top().DataAtom == a.Option {
-				p.oe.pop()
-			}
-			p.addElement()
-		case a.Optgroup:
-			if p.top().DataAtom == a.Option {
-				p.oe.pop()
-			}
-			if p.top().DataAtom == a.Optgroup {
-				p.oe.pop()
-			}
-			p.addElement()
-		case a.Select:
-			if !p.popUntil(selectScope, a.Select) {
-				// Ignore the token.
-				return true
-			}
-			p.resetInsertionMode()
-		case a.Input, a.Keygen, a.Textarea:
-			if p.elementInScope(selectScope, a.Select) {
-				p.parseImpliedToken(EndTagToken, a.Select, a.Select.String())
-				return false
-			}
-			// In order to properly ignore <textarea>, we need to change the tokenizer mode.
-			p.tokenizer.NextIsNotRawText()
-			// Ignore the token.
-			return true
-		case a.Script, a.Template:
-			return inHeadIM(p)
-		case a.Iframe, a.Noembed, a.Noframes, a.Noscript, a.Plaintext, a.Style, a.Title, a.Xmp:
-			// Don't let the tokenizer go into raw text mode when there are raw tags
-			// to be ignored. These tags should be ignored from the tokenizer
-			// properly.
-			p.tokenizer.NextIsNotRawText()
-			// Ignore the token.
-			return true
-		}
-	case EndTagToken:
-		switch p.tok.DataAtom {
-		case a.Option:
-			if p.top().DataAtom == a.Option {
-				p.oe.pop()
-			}
-		case a.Optgroup:
-			i := len(p.oe) - 1
-			if p.oe[i].DataAtom == a.Option {
-				i--
-			}
-			if p.oe[i].DataAtom == a.Optgroup {
-				p.oe = p.oe[:i]
-			}
-		case a.Select:
-			if !p.popUntil(selectScope, a.Select) {
-				// Ignore the token.
-				return true
-			}
-			p.resetInsertionMode()
-		case a.Template:
-			return inHeadIM(p)
-		}
-	case CommentToken:
-		p.addChild(&Node{
-			Type: CommentNode,
-			Data: p.tok.Data,
-		})
-	case DoctypeToken:
-		// Ignore the token.
-		return true
-	case ErrorToken:
-		return inBodyIM(p)
-	}
-
-	return true
-}
-
-// Section 12.2.6.4.17.
-func inSelectInTableIM(p *parser) bool {
-	switch p.tok.Type {
-	case StartTagToken, EndTagToken:
-		switch p.tok.DataAtom {
-		case a.Caption, a.Table, a.Tbody, a.Tfoot, a.Thead, a.Tr, a.Td, a.Th:
-			if p.tok.Type == EndTagToken && !p.elementInScope(tableScope, p.tok.DataAtom) {
-				// Ignore the token.
-				return true
-			}
-			// This is like p.popUntil(selectScope, a.Select), but it also
-			// matches <math select>, not just <select>. Matching the MathML
-			// tag is arguably incorrect (conceptually), but it mimics what
-			// Chromium does.
-			for i := len(p.oe) - 1; i >= 0; i-- {
-				if n := p.oe[i]; n.DataAtom == a.Select {
-					p.oe = p.oe[:i]
-					break
-				}
-			}
-			p.resetInsertionMode()
-			return false
-		}
-	}
-	return inSelectIM(p)
-}
-
 // Section 12.2.6.4.18.
 func inTemplateIM(p *parser) bool {
 	switch p.tok.Type {
@@ -2174,7 +2061,7 @@
 
 const whitespaceOrNUL = whitespace + "\x00"
 
-// Section 12.2.6.5
+// Section 13.2.6.5
 func parseForeignContent(p *parser) bool {
 	switch p.tok.Type {
 	case TextToken:
@@ -2189,28 +2076,26 @@
 			Data: p.tok.Data,
 		})
 	case StartTagToken:
-		if !p.fragment {
-			b := breakout[p.tok.Data]
-			if p.tok.DataAtom == a.Font {
-			loop:
-				for _, attr := range p.tok.Attr {
-					switch attr.Key {
-					case "color", "face", "size":
-						b = true
-						break loop
-					}
+		b := breakout[p.tok.Data]
+		if p.tok.DataAtom == a.Font {
+		loop:
+			for _, attr := range p.tok.Attr {
+				switch attr.Key {
+				case "color", "face", "size":
+					b = true
+					break loop
 				}
 			}
-			if b {
-				for i := len(p.oe) - 1; i >= 0; i-- {
-					n := p.oe[i]
-					if n.Namespace == "" || htmlIntegrationPoint(n) || mathMLTextIntegrationPoint(n) {
-						p.oe = p.oe[:i+1]
-						break
-					}
+		}
+		if b {
+			for i := len(p.oe) - 1; i >= 0; i-- {
+				n := p.oe[i]
+				if n.Namespace == "" || htmlIntegrationPoint(n) || mathMLTextIntegrationPoint(n) {
+					p.oe = p.oe[:i+1]
+					break
 				}
-				return false
 			}
+			return p.im(p)
 		}
 		current := p.adjustedCurrentNode()
 		switch current.Namespace {
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/net/html/token.go /work/src/external-provisioner/vendor/golang.org/x/net/html/token.go
--- a/vendor/golang.org/x/net/html/token.go	2026-09-05 00:02:32.150804738 +0000
+++ b/vendor/golang.org/x/net/html/token.go	2026-09-05 00:03:04.446979762 +0000
@@ -704,7 +704,11 @@
 	for i := 0; i < 2; i++ {
 		c[i] = z.readByte()
 		if z.err != nil {
+			// bogus comment
 			z.data.end = z.raw.end
+			if i == 1 && c[0] == '>' {
+				z.data.end--
+			}
 			return CommentToken
 		}
 	}
@@ -732,6 +736,13 @@
 	for i := 0; i < len(s); i++ {
 		c := z.readByte()
 		if z.err != nil {
+			if z.err == io.EOF {
+				// Back up to read the fragment of "DOCTYPE" again, reset
+				// z.err to signal EOF on the next call
+				z.raw.end = z.data.start
+				z.err = nil
+				return false
+			}
 			z.data.end = z.raw.end
 			return false
 		}
@@ -757,6 +768,13 @@
 	for i := 0; i < len(s); i++ {
 		c := z.readByte()
 		if z.err != nil {
+			if z.err == io.EOF {
+				// Back up to read the fragment of "[CDATA[" again, reset
+				// z.err to signal EOF on the next call
+				z.raw.end = z.data.start
+				z.err = nil
+				return false
+			}
 			z.data.end = z.raw.end
 			return false
 		}
@@ -883,7 +901,7 @@
 		z.readTagAttrKey()
 		z.readTagAttrVal()
 		// Save pendingAttr if saveAttr and that attribute has a non-empty key, and the key hasn't been seen before.
-		key := strings.ToLower(string(z.buf[z.pendingAttr[0].start:z.pendingAttr[0].end]))
+		key := string(lower(bytes.Clone(z.buf[z.pendingAttr[0].start:z.pendingAttr[0].end])))
 		if saveAttr && z.pendingAttr[0].start != z.pendingAttr[0].end && !z.attrNames[key] {
 			z.attr = append(z.attr, z.pendingAttr)
 			z.attrNames[key] = true
@@ -1206,7 +1224,7 @@
 	if z.data.start < z.data.end {
 		switch z.tt {
 		case StartTagToken, EndTagToken, SelfClosingTagToken:
-			s := z.buf[z.data.start:z.data.end]
+			s := bytes.ReplaceAll(z.buf[z.data.start:z.data.end], nul, replacement)
 			z.data.start = z.raw.end
 			z.data.end = z.raw.end
 			return lower(s), z.nAttrReturned < len(z.attr)
@@ -1224,8 +1242,8 @@
 		case StartTagToken, SelfClosingTagToken:
 			x := z.attr[z.nAttrReturned]
 			z.nAttrReturned++
-			key = z.buf[x[0].start:x[0].end]
-			val = z.buf[x[1].start:x[1].end]
+			key = bytes.ReplaceAll(z.buf[x[0].start:x[0].end], nul, replacement)
+			val = bytes.ReplaceAll(z.buf[x[1].start:x[1].end], nul, replacement)
 			return lower(key), unescape(convertNewlines(val), true), z.nAttrReturned < len(z.attr)
 		}
 	}
@@ -1282,9 +1300,22 @@
 		attrNames: make(map[string]bool),
 	}
 	if contextTag != "" {
+		// Per the "Parsing HTML Fragments" portion of the spec:
+		//    For performance reasons, an implementation that does not report errors
+		//    and that uses the actual state machine described in this specification
+		//    directly could use the PLAINTEXT state instead of the RAWTEXT and script
+		//    data states where those are mentioned in the list above. Except for
+		//    rules regarding parse errors, they are equivalent, since there is no
+		//    appropriate end tag token in the fragment case, yet they involve far
+		//    fewer state transitions.
+		//
+		// As such we just set everything to plaintext, which makes some complex parsing
+		// cases somewhat simpler.
 		switch s := strings.ToLower(contextTag); s {
-		case "iframe", "noembed", "noframes", "noscript", "plaintext", "script", "style", "title", "textarea", "xmp":
+		case "title", "textarea":
 			z.rawTag = s
+		case "style", "xmp", "iframe", "noembed", "noframes", "script", "noscript", "plaintext":
+			z.rawTag = "plaintext"
 		}
 	}
 	return z
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/net/http2/server_wrap.go /work/src/external-provisioner/vendor/golang.org/x/net/http2/server_wrap.go
--- a/vendor/golang.org/x/net/http2/server_wrap.go	2026-09-05 00:02:32.154804758 +0000
+++ b/vendor/golang.org/x/net/http2/server_wrap.go	2026-09-05 00:03:04.446979762 +0000
@@ -10,9 +10,11 @@
 
 import (
 	"context"
+	"crypto/tls"
 	"errors"
 	"net"
 	"net/http"
+	"slices"
 	"sync"
 	"time"
 )
@@ -44,6 +46,20 @@
 			h2.IdleTimeout = h1.ReadTimeout
 		}
 	}
+
+	// Register h2 and http/1.1 ALPN protocols on s.TLSConfig, matching
+	// the pre-wrapping implementation in server.go, so that TLS listeners
+	// built from s.TLSConfig still negotiate HTTP/2.
+	if s.TLSConfig == nil {
+		s.TLSConfig = new(tls.Config)
+	}
+	if !slices.Contains(s.TLSConfig.NextProtos, NextProtoTLS) {
+		s.TLSConfig.NextProtos = append(s.TLSConfig.NextProtos, NextProtoTLS)
+	}
+	if !slices.Contains(s.TLSConfig.NextProtos, "http/1.1") {
+		s.TLSConfig.NextProtos = append(s.TLSConfig.NextProtos, "http/1.1")
+	}
+
 	conf.state = &serverInternalState{
 		s1: s,
 	}
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/net/http2/transport_wrap.go /work/src/external-provisioner/vendor/golang.org/x/net/http2/transport_wrap.go
--- a/vendor/golang.org/x/net/http2/transport_wrap.go	2026-09-05 00:02:32.154804758 +0000
+++ b/vendor/golang.org/x/net/http2/transport_wrap.go	2026-09-05 00:03:04.446979762 +0000
@@ -22,8 +22,8 @@
 )
 
 func configureTransport(t1 *http.Transport) error {
-	// ConfigureTransport is a no-op: The http.Transport already supports HTTP/2.
-	return nil
+	_, err := configureTransports(t1)
+	return err
 }
 
 func configureTransports(t1 *http.Transport) (*Transport, error) {
@@ -31,6 +31,17 @@
 	// linked to the http.Transport's.
 	tr2 := &Transport{}
 	tr2.configure(t1)
+	// Enable HTTP/2 on the transport, as the pre-wrapping implementation did:
+	// net/http does not auto-enable it for a transport with a custom
+	// TLSClientConfig or dialer.
+	if t1.TLSClientConfig == nil {
+		t1.TLSClientConfig = &tls.Config{}
+	}
+	if t1.Protocols == nil {
+		t1.Protocols = new(http.Protocols)
+		t1.Protocols.SetHTTP1(true)
+	}
+	t1.Protocols.SetHTTP2(true)
 	return tr2, nil
 }
 
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sync/errgroup/errgroup.go /work/src/external-provisioner/vendor/golang.org/x/sync/errgroup/errgroup.go
--- a/vendor/golang.org/x/sync/errgroup/errgroup.go	2026-09-05 00:02:32.162804798 +0000
+++ b/vendor/golang.org/x/sync/errgroup/errgroup.go	2026-09-05 00:03:04.502980048 +0000
@@ -109,7 +109,7 @@
 	if g.sem != nil {
 		select {
 		case g.sem <- token{}:
-			// Note: this allows barging iff channels in general allow barging.
+			// Note: this allows barging if and only if channels in general allow barging.
 		default:
 			return false
 		}
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sync/singleflight/singleflight.go /work/src/external-provisioner/vendor/golang.org/x/sync/singleflight/singleflight.go
--- a/vendor/golang.org/x/sync/singleflight/singleflight.go	2026-09-05 00:02:32.162804798 +0000
+++ b/vendor/golang.org/x/sync/singleflight/singleflight.go	2026-09-05 00:03:04.502980048 +0000
@@ -15,12 +15,12 @@
 	"sync"
 )
 
-// errGoexit indicates the runtime.Goexit was called in
-// the user given function.
+// errGoexit indicates runtime.Goexit was called in
+// the user-given function.
 var errGoexit = errors.New("runtime.Goexit was called")
 
 // A panicError is an arbitrary value recovered from a panic
-// with the stack trace during the execution of given function.
+// with the stack trace during the execution of the given function.
 type panicError struct {
 	value any
 	stack []byte
@@ -204,7 +204,7 @@
 	}
 }
 
-// Forget tells the singleflight to forget about a key.  Future calls
+// Forget tells the singleflight to forget about a key. Future calls
 // to Do for this key will call the function rather than waiting for
 // an earlier call to complete.
 func (g *Group) Forget(key string) {
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/cpu/parse.go /work/src/external-provisioner/vendor/golang.org/x/sys/cpu/parse.go
--- a/vendor/golang.org/x/sys/cpu/parse.go	2026-09-05 00:02:32.166804818 +0000
+++ b/vendor/golang.org/x/sys/cpu/parse.go	2026-09-05 00:03:04.518980129 +0000
@@ -6,38 +6,50 @@
 
 import "strconv"
 
-// parseRelease parses a dot-separated version number. It follows the semver
-// syntax, but allows the minor and patch versions to be elided.
+// parseRelease parses a dot-separated version number from the prefix
+// of rel. It returns ok=true only if at least the major and minor
+// components were successfully parsed; the patch component is
+// best-effort. Trailing vendor or build suffixes such as
+// "-generic", "+", "_hi3535", or "-rc1" are ignored.
 //
 // This is a copy of the Go runtime's parseRelease from
-// https://golang.org/cl/209597.
+// https://golang.org/cl/209597, updated in https://golang.org/cl/781800.
 func parseRelease(rel string) (major, minor, patch int, ok bool) {
-	// Strip anything after a dash or plus.
-	for i := range len(rel) {
-		if rel[i] == '-' || rel[i] == '+' {
-			rel = rel[:i]
-			break
+	// next consumes a run of decimal digits from the front of rel,
+	// returning the parsed value. If the digits are followed by a
+	// '.', it is consumed and more is set so the caller knows to
+	// parse another component; otherwise scanning terminates and
+	// the rest of rel is discarded.
+	next := func() (n int, more, ok bool) {
+		i := 0
+		for i < len(rel) && rel[i] >= '0' && rel[i] <= '9' {
+			i++
 		}
-	}
-
-	next := func() (int, bool) {
-		for i := range len(rel) {
-			if rel[i] == '.' {
-				ver, err := strconv.Atoi(rel[:i])
-				rel = rel[i+1:]
-				return ver, err == nil
-			}
+		if i == 0 {
+			return 0, false, false
+		}
+		n, err := strconv.Atoi(rel[:i])
+		if err != nil {
+			return 0, false, false
+		}
+		if i < len(rel) && rel[i] == '.' {
+			rel = rel[i+1:]
+			return n, true, true
 		}
-		ver, err := strconv.Atoi(rel)
 		rel = ""
-		return ver, err == nil
+		return n, false, true
+	}
+
+	var more bool
+	if major, more, ok = next(); !ok || !more {
+		return 0, 0, 0, false
 	}
-	if major, ok = next(); !ok || rel == "" {
-		return
+	if minor, more, ok = next(); !ok {
+		return 0, 0, 0, false
 	}
-	if minor, ok = next(); !ok || rel == "" {
-		return
+	if !more {
+		return major, minor, 0, true
 	}
-	patch, ok = next()
-	return
+	patch, _, _ = next()
+	return major, minor, patch, true
 }
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/syscall_linux.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/syscall_linux.go
--- a/vendor/golang.org/x/sys/unix/syscall_linux.go	2026-09-05 00:02:32.170804837 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_linux.go	2026-09-05 00:03:04.526980170 +0000
@@ -1874,6 +1874,7 @@
 //sys	Dup3(oldfd int, newfd int, flags int) (err error)
 //sysnb	EpollCreate1(flag int) (fd int, err error)
 //sysnb	EpollCtl(epfd int, op int, fd int, event *EpollEvent) (err error)
+//sys	EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) = SYS_EPOLL_PWAIT
 //sys	Eventfd(initval uint, flags int) (fd int, err error) = SYS_EVENTFD2
 //sys	Exit(code int) = SYS_EXIT_GROUP
 //sys	Fallocate(fd int, mode uint32, off int64, len int64) (err error)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/syscall_linux_386.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/syscall_linux_386.go
--- a/vendor/golang.org/x/sys/unix/syscall_linux_386.go	2026-09-05 00:02:32.170804837 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_386.go	2026-09-05 00:03:04.526980170 +0000
@@ -20,7 +20,6 @@
 
 // 64-bit file system and 32-bit uid calls
 // (386 default is 32-bit file system and 16-bit uid).
-//sys	EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error)
 //sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = SYS_FADVISE64_64
 //sys	Fchown(fd int, uid int, gid int) (err error) = SYS_FCHOWN32
 //sys	Fstat(fd int, stat *Stat_t) (err error) = SYS_FSTAT64
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/syscall_linux_amd64.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/syscall_linux_amd64.go
--- a/vendor/golang.org/x/sys/unix/syscall_linux_amd64.go	2026-09-05 00:02:32.170804837 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_amd64.go	2026-09-05 00:03:04.526980170 +0000
@@ -6,7 +6,6 @@
 
 package unix
 
-//sys	EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error)
 //sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = SYS_FADVISE64
 //sys	Fchown(fd int, uid int, gid int) (err error)
 //sys	Fstat(fd int, stat *Stat_t) (err error)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/syscall_linux_arm.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/syscall_linux_arm.go
--- a/vendor/golang.org/x/sys/unix/syscall_linux_arm.go	2026-09-05 00:02:32.170804837 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_arm.go	2026-09-05 00:03:04.526980170 +0000
@@ -44,7 +44,6 @@
 
 // 64-bit file system and 32-bit uid calls
 // (16-bit uid calls are not always supported in newer kernels)
-//sys	EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error)
 //sys	Fchown(fd int, uid int, gid int) (err error) = SYS_FCHOWN32
 //sys	Fstat(fd int, stat *Stat_t) (err error) = SYS_FSTAT64
 //sys	Fstatat(dirfd int, path string, stat *Stat_t, flags int) (err error) = SYS_FSTATAT64
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/syscall_linux_arm64.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/syscall_linux_arm64.go
--- a/vendor/golang.org/x/sys/unix/syscall_linux_arm64.go	2026-09-05 00:02:32.170804837 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_arm64.go	2026-09-05 00:03:04.526980170 +0000
@@ -8,7 +8,6 @@
 
 import "unsafe"
 
-//sys	EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) = SYS_EPOLL_PWAIT
 //sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = SYS_FADVISE64
 //sys	Fchown(fd int, uid int, gid int) (err error)
 //sys	Fstat(fd int, stat *Stat_t) (err error)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/syscall_linux_loong64.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/syscall_linux_loong64.go
--- a/vendor/golang.org/x/sys/unix/syscall_linux_loong64.go	2026-09-05 00:02:32.170804837 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_loong64.go	2026-09-05 00:03:04.526980170 +0000
@@ -8,7 +8,6 @@
 
 import "unsafe"
 
-//sys	EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) = SYS_EPOLL_PWAIT
 //sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = SYS_FADVISE64
 //sys	Fchown(fd int, uid int, gid int) (err error)
 //sys	Fstatfs(fd int, buf *Statfs_t) (err error)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/syscall_linux_mips64x.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/syscall_linux_mips64x.go
--- a/vendor/golang.org/x/sys/unix/syscall_linux_mips64x.go	2026-09-05 00:02:32.170804837 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_mips64x.go	2026-09-05 00:03:04.526980170 +0000
@@ -6,7 +6,6 @@
 
 package unix
 
-//sys	EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error)
 //sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = SYS_FADVISE64
 //sys	Fchown(fd int, uid int, gid int) (err error)
 //sys	Fstatfs(fd int, buf *Statfs_t) (err error)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/syscall_linux_mipsx.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/syscall_linux_mipsx.go
--- a/vendor/golang.org/x/sys/unix/syscall_linux_mipsx.go	2026-09-05 00:02:32.170804837 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_mipsx.go	2026-09-05 00:03:04.526980170 +0000
@@ -13,7 +13,6 @@
 
 func Syscall9(trap, a1, a2, a3, a4, a5, a6, a7, a8, a9 uintptr) (r1, r2 uintptr, err syscall.Errno)
 
-//sys	EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error)
 //sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = SYS_FADVISE64
 //sys	Fchown(fd int, uid int, gid int) (err error)
 //sys	Ftruncate(fd int, length int64) (err error) = SYS_FTRUNCATE64
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/syscall_linux_ppc.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/syscall_linux_ppc.go
--- a/vendor/golang.org/x/sys/unix/syscall_linux_ppc.go	2026-09-05 00:02:32.170804837 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_ppc.go	2026-09-05 00:03:04.526980170 +0000
@@ -11,7 +11,6 @@
 	"unsafe"
 )
 
-//sys	EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error)
 //sys	Fchown(fd int, uid int, gid int) (err error)
 //sys	Fstat(fd int, stat *Stat_t) (err error) = SYS_FSTAT64
 //sys	Fstatat(dirfd int, path string, stat *Stat_t, flags int) (err error) = SYS_FSTATAT64
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/syscall_linux_ppc64x.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/syscall_linux_ppc64x.go
--- a/vendor/golang.org/x/sys/unix/syscall_linux_ppc64x.go	2026-09-05 00:02:32.170804837 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_ppc64x.go	2026-09-05 00:03:04.526980170 +0000
@@ -6,7 +6,6 @@
 
 package unix
 
-//sys	EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error)
 //sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = SYS_FADVISE64
 //sys	Fchown(fd int, uid int, gid int) (err error)
 //sys	Fstat(fd int, stat *Stat_t) (err error)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go
--- a/vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go	2026-09-05 00:02:32.170804837 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go	2026-09-05 00:03:04.526980170 +0000
@@ -8,7 +8,6 @@
 
 import "unsafe"
 
-//sys	EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) = SYS_EPOLL_PWAIT
 //sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = SYS_FADVISE64
 //sys	Fchown(fd int, uid int, gid int) (err error)
 //sys	Fstat(fd int, stat *Stat_t) (err error)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/syscall_linux_s390x.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/syscall_linux_s390x.go
--- a/vendor/golang.org/x/sys/unix/syscall_linux_s390x.go	2026-09-05 00:02:32.170804837 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_s390x.go	2026-09-05 00:03:04.526980170 +0000
@@ -10,7 +10,6 @@
 	"unsafe"
 )
 
-//sys	EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error)
 //sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = SYS_FADVISE64
 //sys	Fchown(fd int, uid int, gid int) (err error)
 //sys	Fstat(fd int, stat *Stat_t) (err error)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/syscall_linux_sparc64.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/syscall_linux_sparc64.go
--- a/vendor/golang.org/x/sys/unix/syscall_linux_sparc64.go	2026-09-05 00:02:32.170804837 +0000
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_sparc64.go	2026-09-05 00:03:04.526980170 +0000
@@ -6,7 +6,6 @@
 
 package unix
 
-//sys	EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error)
 //sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = SYS_FADVISE64
 //sys	Fchown(fd int, uid int, gid int) (err error)
 //sys	Fstat(fd int, stat *Stat_t) (err error)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/zerrors_linux.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/zerrors_linux.go
--- a/vendor/golang.org/x/sys/unix/zerrors_linux.go	2026-09-05 00:02:32.174804858 +0000
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux.go	2026-09-05 00:03:04.530980191 +0000
@@ -1359,6 +1359,7 @@
 	FAN_UNLIMITED_MARKS                         = 0x20
 	FAN_UNLIMITED_QUEUE                         = 0x10
 	FD_CLOEXEC                                  = 0x1
+	FD_PIDFS_ROOT                               = -0x2712
 	FD_SETSIZE                                  = 0x400
 	FF0                                         = 0x0
 	FIB_RULE_DEV_DETACHED                       = 0x8
@@ -1970,6 +1971,8 @@
 	MADV_DONTNEED                               = 0x4
 	MADV_DONTNEED_LOCKED                        = 0x18
 	MADV_FREE                                   = 0x8
+	MADV_GUARD_INSTALL                          = 0x66
+	MADV_GUARD_REMOVE                           = 0x67
 	MADV_HUGEPAGE                               = 0xe
 	MADV_HWPOISON                               = 0x64
 	MADV_KEEPONFORK                             = 0x13
@@ -2114,7 +2117,7 @@
 	MS_NOSEC                                    = 0x10000000
 	MS_NOSUID                                   = 0x2
 	MS_NOSYMFOLLOW                              = 0x100
-	MS_NOUSER                                   = -0x80000000
+	MS_NOUSER                                   = 0x80000000
 	MS_POSIXACL                                 = 0x10000
 	MS_PRIVATE                                  = 0x40000
 	MS_RDONLY                                   = 0x1
@@ -3786,6 +3789,9 @@
 	TCPOPT_TIMESTAMP                            = 0x8
 	TCPOPT_TSTAMP_HDR                           = 0x101080a
 	TCPOPT_WINDOW                               = 0x3
+	TCP_AO_KEYF_EXCLUDE_OPT                     = 0x2
+	TCP_AO_KEYF_IFINDEX                         = 0x1
+	TCP_AO_MAXKEYLEN                            = 0x50
 	TCP_CC_INFO                                 = 0x1a
 	TCP_CM_INQ                                  = 0x24
 	TCP_CONGESTION                              = 0xd
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux.go	2026-09-05 00:02:32.178804876 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux.go	2026-09-05 00:03:04.534980211 +0000
@@ -700,6 +700,23 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
+func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
+	var _p0 unsafe.Pointer
+	if len(events) > 0 {
+		_p0 = unsafe.Pointer(&events[0])
+	} else {
+		_p0 = unsafe.Pointer(&_zero)
+	}
+	r0, _, e1 := Syscall6(SYS_EPOLL_PWAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
+	n = int(r0)
+	if e1 != 0 {
+		err = errnoErr(e1)
+	}
+	return
+}
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func Eventfd(initval uint, flags int) (fd int, err error) {
 	r0, _, e1 := Syscall(SYS_EVENTFD2, uintptr(initval), uintptr(flags), 0)
 	fd = int(r0)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_386.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_386.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_386.go	2026-09-05 00:02:32.178804876 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_386.go	2026-09-05 00:03:04.534980211 +0000
@@ -45,23 +45,6 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_WAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_FADVISE64_64, uintptr(fd), uintptr(offset), uintptr(offset>>32), uintptr(length), uintptr(length>>32), uintptr(advice))
 	if e1 != 0 {
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_amd64.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_amd64.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_amd64.go	2026-09-05 00:02:32.178804876 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_amd64.go	2026-09-05 00:03:04.534980211 +0000
@@ -45,23 +45,6 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_WAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_FADVISE64, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_arm.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_arm.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_arm.go	2026-09-05 00:02:32.178804876 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_arm.go	2026-09-05 00:03:04.534980211 +0000
@@ -213,23 +213,6 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_WAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fchown(fd int, uid int, gid int) (err error) {
 	_, _, e1 := Syscall(SYS_FCHOWN32, uintptr(fd), uintptr(uid), uintptr(gid))
 	if e1 != 0 {
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_arm64.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_arm64.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_arm64.go	2026-09-05 00:02:32.178804876 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_arm64.go	2026-09-05 00:03:04.534980211 +0000
@@ -45,23 +45,6 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_PWAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_FADVISE64, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_loong64.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_loong64.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_loong64.go	2026-09-05 00:02:32.178804876 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_loong64.go	2026-09-05 00:03:04.534980211 +0000
@@ -45,23 +45,6 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_PWAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_FADVISE64, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_mips.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_mips.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_mips.go	2026-09-05 00:02:32.178804876 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_mips.go	2026-09-05 00:03:04.534980211 +0000
@@ -45,23 +45,6 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_WAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall9(SYS_FADVISE64, uintptr(fd), 0, uintptr(offset>>32), uintptr(offset), uintptr(length>>32), uintptr(length), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_mips64.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_mips64.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_mips64.go	2026-09-05 00:02:32.178804876 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_mips64.go	2026-09-05 00:03:04.534980211 +0000
@@ -45,23 +45,6 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_WAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_FADVISE64, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_mips64le.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_mips64le.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_mips64le.go	2026-09-05 00:02:32.178804876 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_mips64le.go	2026-09-05 00:03:04.534980211 +0000
@@ -45,23 +45,6 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_WAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_FADVISE64, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_mipsle.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_mipsle.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_mipsle.go	2026-09-05 00:02:32.178804876 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_mipsle.go	2026-09-05 00:03:04.534980211 +0000
@@ -45,23 +45,6 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_WAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall9(SYS_FADVISE64, uintptr(fd), 0, uintptr(offset), uintptr(offset>>32), uintptr(length), uintptr(length>>32), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc.go	2026-09-05 00:02:32.178804876 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc.go	2026-09-05 00:03:04.534980211 +0000
@@ -45,23 +45,6 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_WAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fchown(fd int, uid int, gid int) (err error) {
 	_, _, e1 := Syscall(SYS_FCHOWN, uintptr(fd), uintptr(uid), uintptr(gid))
 	if e1 != 0 {
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc64.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc64.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc64.go	2026-09-05 00:02:32.178804876 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc64.go	2026-09-05 00:03:04.534980211 +0000
@@ -45,23 +45,6 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_WAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_FADVISE64, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc64le.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc64le.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc64le.go	2026-09-05 00:02:32.178804876 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_ppc64le.go	2026-09-05 00:03:04.534980211 +0000
@@ -45,23 +45,6 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_WAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_FADVISE64, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_riscv64.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_riscv64.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_riscv64.go	2026-09-05 00:02:32.178804876 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_riscv64.go	2026-09-05 00:03:04.534980211 +0000
@@ -45,23 +45,6 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_PWAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_FADVISE64, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_s390x.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_s390x.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_s390x.go	2026-09-05 00:02:32.178804876 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_s390x.go	2026-09-05 00:03:04.534980211 +0000
@@ -45,23 +45,6 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_WAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_FADVISE64, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_sparc64.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/zsyscall_linux_sparc64.go
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux_sparc64.go	2026-09-05 00:02:32.178804876 +0000
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux_sparc64.go	2026-09-05 00:03:04.534980211 +0000
@@ -45,23 +45,6 @@
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func EpollWait(epfd int, events []EpollEvent, msec int) (n int, err error) {
-	var _p0 unsafe.Pointer
-	if len(events) > 0 {
-		_p0 = unsafe.Pointer(&events[0])
-	} else {
-		_p0 = unsafe.Pointer(&_zero)
-	}
-	r0, _, e1 := Syscall6(SYS_EPOLL_WAIT, uintptr(epfd), uintptr(_p0), uintptr(len(events)), uintptr(msec), 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fadvise(fd int, offset int64, length int64, advice int) (err error) {
 	_, _, e1 := Syscall6(SYS_FADVISE64, uintptr(fd), uintptr(offset), uintptr(length), uintptr(advice), 0, 0)
 	if e1 != 0 {
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux.go	2026-09-05 00:02:32.182804896 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux.go	2026-09-05 00:03:04.538980232 +0000
@@ -6397,3 +6397,79 @@
 	MPOL_PREFERRED_MANY      = 0x5
 	MPOL_WEIGHTED_INTERLEAVE = 0x6
 )
+
+const (
+	GPIO_V2_GET_LINEINFO_IOCTL       = 0xc100b405
+	GPIO_V2_GET_LINE_IOCTL           = 0xc250b407
+	GPIO_V2_LINE_GET_VALUES_IOCTL    = 0xc010b40e
+	GPIO_V2_LINE_SET_VALUES_IOCTL    = 0xc010b40f
+	GPIO_V2_GET_LINEINFO_WATCH_IOCTL = 0xc100b406
+	GPIO_GET_LINEINFO_UNWATCH_IOCTL  = 0xc004b40c
+)
+const (
+	GPIO_V2_LINE_ATTR_ID_FLAGS         = 0x1
+	GPIO_V2_LINE_ATTR_ID_OUTPUT_VALUES = 0x2
+	GPIO_V2_LINE_ATTR_ID_DEBOUNCE      = 0x3
+	GPIO_V2_LINE_CHANGED_REQUESTED     = 0x1
+	GPIO_V2_LINE_CHANGED_RELEASED      = 0x2
+	GPIO_V2_LINE_CHANGED_CONFIG        = 0x3
+	GPIO_V2_LINE_EVENT_RISING_EDGE     = 0x1
+	GPIO_V2_LINE_EVENT_FALLING_EDGE    = 0x2
+)
+
+type GPIOChipInfo struct {
+	Name  [32]byte
+	Label [32]byte
+	Lines uint32
+}
+type GPIOV2LineValues struct {
+	Bits uint64
+	Mask uint64
+}
+type GPIOV2LineAttribute struct {
+	Id    uint32
+	_     uint32
+	Flags uint64
+}
+type GPIOV2LineConfigAttribute struct {
+	Attr GPIOV2LineAttribute
+	Mask uint64
+}
+type GPIOV2LineConfig struct {
+	Flags     uint64
+	Num_attrs uint32
+	_         [5]uint32
+	Attrs     [10]GPIOV2LineConfigAttribute
+}
+type GPIOV2LineRequest struct {
+	Offsets           [64]uint32
+	Consumer          [32]byte
+	Config            GPIOV2LineConfig
+	Num_lines         uint32
+	Event_buffer_size uint32
+	_                 [5]uint32
+	Fd                int32
+}
+type GPIOV2LineInfo struct {
+	Name      [32]byte
+	Consumer  [32]byte
+	Offset    uint32
+	Num_attrs uint32
+	Flags     uint64
+	Attrs     [10]GPIOV2LineAttribute
+	_         [4]uint32
+}
+type GPIOV2LineInfoChanged struct {
+	Info         GPIOV2LineInfo
+	Timestamp_ns uint64
+	Event_type   uint32
+	_            [5]uint32
+}
+type GPIOV2LineEvent struct {
+	Timestamp_ns uint64
+	Id           uint32
+	Offset       uint32
+	Seqno        uint32
+	Line_seqno   uint32
+	_            [6]uint32
+}
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_386.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_386.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_386.go	2026-09-05 00:02:32.182804896 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_386.go	2026-09-05 00:03:04.538980232 +0000
@@ -711,3 +711,7 @@
 	_          uint32
 	_          uint32
 }
+
+const (
+	GPIO_GET_CHIPINFO_IOCTL = 0x8044b401
+)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go	2026-09-05 00:02:32.182804896 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_amd64.go	2026-09-05 00:03:04.538980232 +0000
@@ -725,3 +725,7 @@
 	_      uint64
 	_      uint64
 }
+
+const (
+	GPIO_GET_CHIPINFO_IOCTL = 0x8044b401
+)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_arm.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_arm.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_arm.go	2026-09-05 00:02:32.182804896 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_arm.go	2026-09-05 00:03:04.538980232 +0000
@@ -705,3 +705,7 @@
 	_          uint32
 	_          uint32
 }
+
+const (
+	GPIO_GET_CHIPINFO_IOCTL = 0x8044b401
+)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go	2026-09-05 00:02:32.182804896 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_arm64.go	2026-09-05 00:03:04.538980232 +0000
@@ -704,3 +704,7 @@
 	_      uint64
 	_      uint64
 }
+
+const (
+	GPIO_GET_CHIPINFO_IOCTL = 0x8044b401
+)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go	2026-09-05 00:02:32.182804896 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_loong64.go	2026-09-05 00:03:04.538980232 +0000
@@ -705,3 +705,7 @@
 	_      uint64
 	_      uint64
 }
+
+const (
+	GPIO_GET_CHIPINFO_IOCTL = 0x8044b401
+)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_mips.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_mips.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_mips.go	2026-09-05 00:02:32.182804896 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_mips.go	2026-09-05 00:03:04.538980232 +0000
@@ -710,3 +710,7 @@
 	Ctime_high uint16
 	_          uint16
 }
+
+const (
+	GPIO_GET_CHIPINFO_IOCTL = 0x4044b401
+)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go	2026-09-05 00:02:32.182804896 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_mips64.go	2026-09-05 00:03:04.538980232 +0000
@@ -707,3 +707,7 @@
 	_      uint64
 	_      uint64
 }
+
+const (
+	GPIO_GET_CHIPINFO_IOCTL = 0x4044b401
+)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go	2026-09-05 00:02:32.182804896 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_mips64le.go	2026-09-05 00:03:04.538980232 +0000
@@ -707,3 +707,7 @@
 	_      uint64
 	_      uint64
 }
+
+const (
+	GPIO_GET_CHIPINFO_IOCTL = 0x4044b401
+)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go	2026-09-05 00:02:32.186804916 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_mipsle.go	2026-09-05 00:03:04.538980232 +0000
@@ -710,3 +710,7 @@
 	Ctime_high uint16
 	_          uint16
 }
+
+const (
+	GPIO_GET_CHIPINFO_IOCTL = 0x4044b401
+)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go	2026-09-05 00:02:32.186804916 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_ppc.go	2026-09-05 00:03:04.538980232 +0000
@@ -718,3 +718,7 @@
 	_          uint32
 	_          [4]byte
 }
+
+const (
+	GPIO_GET_CHIPINFO_IOCTL = 0x4044b401
+)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go	2026-09-05 00:02:32.186804916 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64.go	2026-09-05 00:03:04.538980232 +0000
@@ -713,3 +713,7 @@
 	_      uint64
 	_      uint64
 }
+
+const (
+	GPIO_GET_CHIPINFO_IOCTL = 0x4044b401
+)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go	2026-09-05 00:02:32.186804916 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_ppc64le.go	2026-09-05 00:03:04.538980232 +0000
@@ -713,3 +713,7 @@
 	_      uint64
 	_      uint64
 }
+
+const (
+	GPIO_GET_CHIPINFO_IOCTL = 0x4044b401
+)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go	2026-09-05 00:02:32.186804916 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go	2026-09-05 00:03:04.538980232 +0000
@@ -792,3 +792,7 @@
 	RISCV_HWPROBE_KEY_ZICBOZ_BLOCK_SIZE  = 0x6
 	RISCV_HWPROBE_WHICH_CPUS             = 0x1
 )
+
+const (
+	GPIO_GET_CHIPINFO_IOCTL = 0x8044b401
+)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go	2026-09-05 00:02:32.186804916 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_s390x.go	2026-09-05 00:03:04.538980232 +0000
@@ -727,3 +727,7 @@
 	_      uint64
 	_      uint64
 }
+
+const (
+	GPIO_GET_CHIPINFO_IOCTL = 0x8044b401
+)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go /work/src/external-provisioner/vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go	2026-09-05 00:02:32.186804916 +0000
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_sparc64.go	2026-09-05 00:03:04.538980232 +0000
@@ -708,3 +708,7 @@
 	_      uint64
 	_      uint64
 }
+
+const (
+	GPIO_GET_CHIPINFO_IOCTL = 0x4044b401
+)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/windows/security_windows.go /work/src/external-provisioner/vendor/golang.org/x/sys/windows/security_windows.go
--- a/vendor/golang.org/x/sys/windows/security_windows.go	2026-09-05 00:02:32.186804916 +0000
+++ b/vendor/golang.org/x/sys/windows/security_windows.go	2026-09-05 00:03:04.550980292 +0000
@@ -1109,17 +1109,53 @@
 )
 
 // This type is the union inside of TRUSTEE and must be created using one of the TrusteeValueFrom* functions.
+//
+// Go pointers stored in a TrusteeValue must be pinned using [runtime.Pinner]
+// for the lifetime of the TrusteeValue.
 type TrusteeValue uintptr
 
+// TrusteeValueFromString is unsafe and should not be used.
+//
+// It returns a uintptr containing a reference to newly-allocated memory
+// which will be freed by the garbage collector.
+// There is no way for the caller to safely reference this memory.
+//
+// To create a [TrusteeValue] from a string, use:
+//
+//	p, err := windows.UTF16PtrFromString(s)
+//	if err != nil {
+//		// handle error
+//	}
+//
+//	// Pin the string for as long as it is used.
+//	var pinner runtime.Pinner
+//	pinner.Pin(p)
+//	defer pinner.Unpin()
+//
+//	tv := TrusteeValue(unsafe.Pointer(p))
+//
+// Deprecated: TrusteeValueFromString is unsafe and should not be used.
 func TrusteeValueFromString(str string) TrusteeValue {
 	return TrusteeValue(unsafe.Pointer(StringToUTF16Ptr(str)))
 }
+
+// TrusteeValueFromSID returns a [TrusteeValue] referencing sid.
+//
+// The caller must pin sid using a [runtime.Pinner] for the lifetime of the TrusteeValue.
 func TrusteeValueFromSID(sid *SID) TrusteeValue {
 	return TrusteeValue(unsafe.Pointer(sid))
 }
+
+// TrusteeValueFromObjectsAndSid returns a [TrusteeValue] referencing objectsAndSid.
+//
+// The caller must pin objectsAndSid using a [runtime.Pinner] for the lifetime of the TrusteeValue.
 func TrusteeValueFromObjectsAndSid(objectsAndSid *OBJECTS_AND_SID) TrusteeValue {
 	return TrusteeValue(unsafe.Pointer(objectsAndSid))
 }
+
+// TrusteeValueFromObjectsAndName returns a [TrusteeValue] referencing objectsAndName.
+//
+// The caller must pin objectsAndName using a [runtime.Pinner] for the lifetime of the TrusteeValue.
 func TrusteeValueFromObjectsAndName(objectsAndName *OBJECTS_AND_NAME) TrusteeValue {
 	return TrusteeValue(unsafe.Pointer(objectsAndName))
 }
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/windows/syscall_windows.go /work/src/external-provisioner/vendor/golang.org/x/sys/windows/syscall_windows.go
--- a/vendor/golang.org/x/sys/windows/syscall_windows.go	2026-09-05 00:02:32.186804916 +0000
+++ b/vendor/golang.org/x/sys/windows/syscall_windows.go	2026-09-05 00:03:04.550980292 +0000
@@ -1728,11 +1728,15 @@
 // the more common *uint16 string type.
 func NewNTString(s string) (*NTString, error) {
 	var nts NTString
-	s8, err := BytePtrFromString(s)
+	s8, err := ByteSliceFromString(s)
 	if err != nil {
 		return nil, err
 	}
-	RtlInitString(&nts, s8)
+	// The source string plus its terminating NUL must fit within MAX_USHORT.
+	if len(s8) > MAX_USHORT {
+		return nil, syscall.EINVAL
+	}
+	RtlInitString(&nts, &s8[0])
 	return &nts, nil
 }
 
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/sys/windows/types_windows.go /work/src/external-provisioner/vendor/golang.org/x/sys/windows/types_windows.go
--- a/vendor/golang.org/x/sys/windows/types_windows.go	2026-09-05 00:02:32.186804916 +0000
+++ b/vendor/golang.org/x/sys/windows/types_windows.go	2026-09-05 00:03:04.550980292 +0000
@@ -169,6 +169,7 @@
 	FORMAT_MESSAGE_ARGUMENT_ARRAY  = 8192
 	FORMAT_MESSAGE_MAX_WIDTH_MASK  = 255
 
+	MAX_USHORT    = 0xffff
 	MAX_PATH      = 260
 	MAX_LONG_PATH = 32768
 
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/text/cases/context.go /work/src/external-provisioner/vendor/golang.org/x/text/cases/context.go
--- a/vendor/golang.org/x/text/cases/context.go	2026-09-05 00:02:32.190804936 +0000
+++ b/vendor/golang.org/x/text/cases/context.go	2026-09-05 00:03:04.574980415 +0000
@@ -249,7 +249,7 @@
 	return c.copy()
 }
 
-// isUpper writes the isUppercase version of the current rune to dst.
+// isUpper reports whether the current rune is in upper case.
 func isUpper(c *context) bool {
 	ct := c.caseType()
 	if c.info&hasMappingMask == 0 || ct == cUpper {
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/text/cases/map.go /work/src/external-provisioner/vendor/golang.org/x/text/cases/map.go
--- a/vendor/golang.org/x/text/cases/map.go	2026-09-05 00:02:32.190804936 +0000
+++ b/vendor/golang.org/x/text/cases/map.go	2026-09-05 00:03:04.574980415 +0000
@@ -774,7 +774,7 @@
 	// From CLDR:
 	// # Special titlecasing for Dutch initial "ij".
 	// ::Any-Title();
-	// # Fix up Ij at the beginning of a "word" (per Any-Title, notUAX #29)
+	// # Fix up Ij at the beginning of a "word" (per Any-Title, not UAX #29)
 	// [:^WB=ALetter:] [:WB=Extend:]* [[:WB=MidLetter:][:WB=MidNumLet:]]? { Ij } → IJ ;
 	if c.src[c.pSrc] != 'I' && c.src[c.pSrc] != 'i' {
 		return title(c)
@@ -794,7 +794,7 @@
 	// From CLDR:
 	// # Special titlecasing for Dutch initial "ij".
 	// ::Any-Title();
-	// # Fix up Ij at the beginning of a "word" (per Any-Title, notUAX #29)
+	// # Fix up Ij at the beginning of a "word" (per Any-Title, not UAX #29)
 	// [:^WB=ALetter:] [:WB=Extend:]* [[:WB=MidLetter:][:WB=MidNumLet:]]? { Ij } → IJ ;
 	if c.src[c.pSrc] != 'I' {
 		return isTitle(c)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/text/unicode/norm/forminfo.go /work/src/external-provisioner/vendor/golang.org/x/text/unicode/norm/forminfo.go
--- a/vendor/golang.org/x/text/unicode/norm/forminfo.go	2026-09-05 00:02:32.206805015 +0000
+++ b/vendor/golang.org/x/text/unicode/norm/forminfo.go	2026-09-05 00:03:04.590980496 +0000
@@ -121,8 +121,12 @@
 //
 // When all 6 bits are zero, the character is inert, meaning it is never
 // influenced by normalization.
+//
+// We set flags to 0x80 (high bit 7 unused in quick check data) to indicate an invalid rune.
 type qcInfo uint8
 
+func (p Properties) isInvalid() bool { return p.flags == 0x80 }
+
 func (p Properties) isYesC() bool { return p.flags&0x10 == 0 }
 func (p Properties) isYesD() bool { return p.flags&0x4 == 0 }
 
@@ -247,6 +251,9 @@
 // to a Properties.  See the comment at the top of the file
 // for more information on the format.
 func compInfo(v uint16, sz int) Properties {
+	if sz == 0 {
+		return Properties{flags: 0x80, size: 1}
+	}
 	if v == 0 {
 		return Properties{size: uint8(sz)}
 	} else if v >= 0x8000 {
@@ -254,7 +261,7 @@
 			size:  uint8(sz),
 			ccc:   uint8(v),
 			tccc:  uint8(v),
-			flags: qcInfo(v >> 8),
+			flags: qcInfo(v>>8) & 0x3f,
 		}
 		if p.ccc > 0 || p.combinesBackward() {
 			p.nLead = uint8(p.flags & 0x3)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/text/unicode/norm/iter.go /work/src/external-provisioner/vendor/golang.org/x/text/unicode/norm/iter.go
--- a/vendor/golang.org/x/text/unicode/norm/iter.go	2026-09-05 00:02:32.206805015 +0000
+++ b/vendor/golang.org/x/text/unicode/norm/iter.go	2026-09-05 00:03:04.590980496 +0000
@@ -376,16 +376,12 @@
 			goto doNorm
 		}
 		prevCC = i.info.tccc
-		sz := int(i.info.size)
-		if sz == 0 {
-			sz = 1 // illegal rune: copy byte-by-byte
-		}
-		p := outp + sz
+		p := outp + int(i.info.size)
 		if p > len(i.buf) {
 			break
 		}
 		outp = p
-		i.p += sz
+		i.p += int(i.info.size)
 		if i.p >= i.rb.nsrc {
 			i.setDone()
 			break
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/text/unicode/norm/normalize.go /work/src/external-provisioner/vendor/golang.org/x/text/unicode/norm/normalize.go
--- a/vendor/golang.org/x/text/unicode/norm/normalize.go	2026-09-05 00:02:32.206805015 +0000
+++ b/vendor/golang.org/x/text/unicode/norm/normalize.go	2026-09-05 00:03:04.590980496 +0000
@@ -148,7 +148,7 @@
 // patched buffer and whether the decomposition is still in progress.
 func patchTail(rb *reorderBuffer) bool {
 	info, p := lastRuneStart(&rb.f, rb.out)
-	if p == -1 || info.size == 0 {
+	if p == -1 || info.isInvalid() {
 		return true
 	}
 	end := p + int(info.size)
@@ -225,7 +225,7 @@
 	}
 	fd := &rb.f
 	if doMerge {
-		var info Properties
+		info := Properties{flags: 0x80, size: 1} // invalid rune
 		if p < n {
 			info = fd.info(src, p)
 			if !info.BoundaryBefore() || info.nLeadingNonStarters() > 0 {
@@ -235,7 +235,7 @@
 				p = decomposeSegment(rb, p, true)
 			}
 		}
-		if info.size == 0 {
+		if info.isInvalid() {
 			rb.doFlush()
 			// Append incomplete UTF-8 encoding.
 			return src.appendSlice(rb.out, p, n)
@@ -314,7 +314,7 @@
 			continue
 		}
 		info := f.info(src, i)
-		if info.size == 0 {
+		if info.isInvalid() {
 			if atEOF {
 				// include incomplete runes
 				return n, true
@@ -379,7 +379,7 @@
 	// CGJ insertion points correctly. Luckily it doesn't have to.
 	for {
 		info := fd.info(src, i)
-		if info.size == 0 {
+		if info.isInvalid() {
 			return -1
 		}
 		if s := ss.next(info); s != ssSuccess {
@@ -424,7 +424,7 @@
 	}
 	fd := formTable[f]
 	info := fd.info(src, 0)
-	if info.size == 0 {
+	if info.isInvalid() {
 		if atEOF {
 			return 1
 		}
@@ -435,7 +435,7 @@
 
 	for i := int(info.size); i < nsrc; i += int(info.size) {
 		info = fd.info(src, i)
-		if info.size == 0 {
+		if info.isInvalid() {
 			if atEOF {
 				return i
 			}
@@ -465,7 +465,7 @@
 	if p == -1 {
 		return -1
 	}
-	if info.size == 0 { // ends with incomplete rune
+	if info.isInvalid() { // ends with incomplete rune
 		if p == 0 { // starts with incomplete rune
 			return -1
 		}
@@ -504,7 +504,7 @@
 func decomposeSegment(rb *reorderBuffer, sp int, atEOF bool) int {
 	// Force one character to be consumed.
 	info := rb.f.info(rb.src, sp)
-	if info.size == 0 {
+	if info.isInvalid() {
 		return 0
 	}
 	if s := rb.ss.next(info); s == ssStarter {
@@ -528,7 +528,7 @@
 			break
 		}
 		info = rb.f.info(rb.src, sp)
-		if info.size == 0 {
+		if info.isInvalid() {
 			if !atEOF {
 				return int(iShortSrc)
 			}
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/tools/go/packages/packages.go /work/src/external-provisioner/vendor/golang.org/x/tools/go/packages/packages.go
--- a/vendor/golang.org/x/tools/go/packages/packages.go	2026-09-05 00:02:32.210805035 +0000
+++ b/vendor/golang.org/x/tools/go/packages/packages.go	2026-09-05 00:03:04.618980640 +0000
@@ -815,6 +815,12 @@
 			needsrc:   needsrc,
 			goVersion: response.GoVersion,
 		}
+		// Don't trust the driver to respond with duplicate-free
+		// package names (go.dev/issue/63822).
+		if _, ok := ld.pkgs[lpkg.ID]; ok {
+			return nil, fmt.Errorf("%s response contained duplicate packages for ID %q",
+				cond(ld.externalDriver, "go/packages driver", "go list"), lpkg.ID)
+		}
 		ld.pkgs[lpkg.ID] = lpkg
 		if rootIndex >= 0 {
 			initial[rootIndex] = lpkg
@@ -1589,3 +1595,11 @@
 }
 
 type unit struct{}
+
+func cond[T any](cond bool, t, f T) T {
+	if cond {
+		return t
+	} else {
+		return f
+	}
+}
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/tools/internal/gcimporter/iexport.go /work/src/external-provisioner/vendor/golang.org/x/tools/internal/gcimporter/iexport.go
--- a/vendor/golang.org/x/tools/internal/gcimporter/iexport.go	2026-09-05 00:02:32.210805035 +0000
+++ b/vendor/golang.org/x/tools/internal/gcimporter/iexport.go	2026-09-05 00:03:04.618980640 +0000
@@ -823,6 +823,9 @@
 			w.pos(m.Pos())
 			w.string(m.Name())
 			sig, _ := m.Type().(*types.Signature)
+			if w.p.version >= iexportVersionGenericMethods && w.bool(sig.TypeParams().Len() > 0) {
+				w.tparamList(obj.Name()+"."+m.Name(), sig.TypeParams(), obj.Pkg())
+			}
 
 			// Receiver type parameters are type arguments of the receiver type, so
 			// their name must be qualified before exporting recv.
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/tools/internal/gcimporter/iimport.go /work/src/external-provisioner/vendor/golang.org/x/tools/internal/gcimporter/iimport.go
--- a/vendor/golang.org/x/tools/internal/gcimporter/iimport.go	2026-09-05 00:02:32.210805035 +0000
+++ b/vendor/golang.org/x/tools/internal/gcimporter/iimport.go	2026-09-05 00:03:04.618980640 +0000
@@ -48,13 +48,14 @@
 
 // Keep this in sync with constants in iexport.go.
 const (
-	iexportVersionGo1_11   = 0
-	iexportVersionPosCol   = 1
-	iexportVersionGo1_18   = 2
-	iexportVersionGenerics = 2
-	iexportVersion         = iexportVersionGenerics
+	iexportVersionGo1_11         = 0
+	iexportVersionPosCol         = 1
+	iexportVersionGo1_18         = 2
+	iexportVersionGenerics       = 2
+	iexportVersionGenericMethods = 3
+	iexportVersion               = iexportVersionGenericMethods
 
-	iexportVersionCurrent = 2
+	iexportVersionCurrent = 3
 )
 
 type ident struct {
@@ -179,9 +180,9 @@
 
 	version = int64(r.uint64())
 	switch version {
-	case iexportVersionGo1_18, iexportVersionPosCol, iexportVersionGo1_11:
+	case iexportVersionGenericMethods, iexportVersionGo1_18, iexportVersionPosCol, iexportVersionGo1_11:
 	default:
-		if version > iexportVersionGo1_18 {
+		if version > iexportVersionGenericMethods {
 			errorf("unstable iexport format version %d, just rebuild compiler and std library", version)
 		} else {
 			errorf("unknown iexport format version %d", version)
@@ -614,6 +615,10 @@
 			for n := r.uint64(); n > 0; n-- {
 				mpos := r.pos()
 				mname := r.ident()
+				var tpars []*types.TypeParam
+				if r.p.version >= iexportVersionGenericMethods && r.bool() {
+					tpars = r.tparamList()
+				}
 				recv := r.param(pkg)
 
 				// If the receiver has any targs, set those as the
@@ -628,8 +633,7 @@
 						rparams[i] = types.Unalias(targs.At(i)).(*types.TypeParam)
 					}
 				}
-				msig := r.signature(pkg, recv, rparams, nil)
-
+				msig := r.signature(pkg, recv, rparams, tpars)
 				named.AddMethod(types.NewFunc(mpos, pkg, mname, msig))
 			}
 		}
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/tools/internal/stdlib/deps.go /work/src/external-provisioner/vendor/golang.org/x/tools/internal/stdlib/deps.go
--- a/vendor/golang.org/x/tools/internal/stdlib/deps.go	2026-09-05 00:02:32.214805055 +0000
+++ b/vendor/golang.org/x/tools/internal/stdlib/deps.go	2026-09-05 00:03:04.622980661 +0000
@@ -12,366 +12,386 @@
 }
 
 var deps = [...]pkginfo{
-	{"archive/tar", "\x03q\x03F=\x01\n\x01$\x01\x01\x02\x05\b\x02\x01\x02\x02\r"},
-	{"archive/zip", "\x02\x04g\a\x03\x13\x021=\x01+\x05\x01\x0f\x03\x02\x0f\x04"},
-	{"bufio", "\x03q\x86\x01D\x15"},
-	{"bytes", "t+[\x03\fH\x02\x02"},
+	{"archive/tar", "\x03{\x03F>\x01\n\x01&\x01\x01\x02\x05\b\x02\x01\x02\x02\r"},
+	{"archive/zip", "\x02\x04j\x0e\x03\x12\x022>\x01-\x05\x01\x0f\x03\x02\x0f\x04"},
+	{"bufio", "\x03{\x87\x01F\x15"},
+	{"bytes", "~*]\x03\fJ\x02\x02"},
 	{"cmp", ""},
-	{"compress/bzip2", "\x02\x02\xf6\x01A"},
-	{"compress/flate", "\x02r\x03\x83\x01\f\x033\x01\x03"},
-	{"compress/gzip", "\x02\x04g\a\x03\x15nU"},
-	{"compress/lzw", "\x02r\x03\x83\x01"},
-	{"compress/zlib", "\x02\x04g\a\x03\x13\x01o"},
-	{"container/heap", "\xbc\x02"},
+	{"compress/bzip2", "\x02\x02\x81\x02C"},
+	{"compress/flate", "\x02|\x03\x84\x01\f\x034\x02\x03"},
+	{"compress/gzip", "\x02\x04j\x0e\x03\x14pW"},
+	{"compress/lzw", "\x02|\x03\x84\x01"},
+	{"compress/zlib", "\x02\x04j\x0e\x03\x12\x01q"},
+	{"container/heap", "\xc9\x02"},
 	{"container/list", ""},
 	{"container/ring", ""},
-	{"context", "t\\p\x01\x0e"},
-	{"crypto", "\x8a\x01pC"},
-	{"crypto/aes", "\x10\v\t\x99\x02"},
-	{"crypto/cipher", "\x03!\x01\x01 \x12\x1c,Z"},
-	{"crypto/des", "\x10\x16 .,\x9d\x01\x03"},
-	{"crypto/dsa", "F\x03+\x86\x01\r"},
-	{"crypto/ecdh", "\x03\v\r\x10\x04\x17\x03\x0f\x1c\x86\x01"},
-	{"crypto/ecdsa", "\x0e\x05\x03\x05\x01\x10\b\v\x06\x01\x03\x0e\x01\x1c\x86\x01\r\x05L\x01"},
-	{"crypto/ed25519", "\x0e\x1f\x12\a\x03\b\a\x1cI=C"},
-	{"crypto/elliptic", "4@\x86\x01\r9"},
-	{"crypto/fips140", "#\x05\x95\x01\x98\x01"},
-	{"crypto/hkdf", "0\x15\x01.\x16"},
-	{"crypto/hmac", "\x1b\x16\x14\x01\x122"},
-	{"crypto/hpke", "\x03\v\x02\x03\x04\x01\f\x01\x05\x1f\x05\a\x01\x01\x1d\x03\x13\x16\x9b\x01\x1c"},
-	{"crypto/internal/boring", "\x0e\x02\x0el"},
-	{"crypto/internal/boring/bbig", "\x1b\xec\x01N"},
-	{"crypto/internal/boring/bcache", "\xc1\x02\x14"},
+	{"context", "~]r\x01\x0e"},
+	{"crypto", "\x93\x01rE"},
+	{"crypto/aes", "\x10\v\n\xa5\x02"},
+	{"crypto/cipher", "\x03\"\x01\x01 \x13$+\\"},
+	{"crypto/des", "\x10\x17 7+\xa1\x01\x03"},
+	{"crypto/dsa", "G\x034\x87\x01\r"},
+	{"crypto/ecdh", "\x03\v\r\x11\x04\x17\x03\x10$\x87\x01"},
+	{"crypto/ecdsa", "\x0e\x05\x03\x05\x01\x11\b\v\x06\x01\x03\x0f\x01$\x87\x01\r\x05O\x01"},
+	{"crypto/ed25519", "\x0e \x12\a\x03\t\a$I>E"},
+	{"crypto/elliptic", "5I\x87\x01\r;"},
+	{"crypto/fips140", "$\x05\x9e\x01\x9b\x01"},
+	{"crypto/hkdf", "1\x15\x017\x15"},
+	{"crypto/hmac", "\x1b\x17\x14\x01\x139"},
+	{"crypto/hpke", "\x03\v\x02\x03\x04\x01\r\x01\x05\x1f\x06\a\x01\x01%\x03\x12\x16\x9f\x01\x1d"},
+	{"crypto/internal/boring", "\x0e\x02\x0eu"},
+	{"crypto/internal/boring/bbig", "\x1b\xf7\x01P"},
+	{"crypto/internal/boring/bcache", "\xce\x02\x14"},
 	{"crypto/internal/boring/sig", ""},
 	{"crypto/internal/constanttime", ""},
-	{"crypto/internal/cryptotest", "\x03\r\v\b%\x10\x19\x06\x13\x12 \x04\x06\t\x19\x01\x11\x11\x1b\x01\a\x05\b\x03\x05\f"},
-	{"crypto/internal/entropy", "K"},
-	{"crypto/internal/entropy/v1.0.0", "D0\x95\x018\x14"},
-	{"crypto/internal/fips140", "C1\xbf\x01\v\x17"},
-	{"crypto/internal/fips140/aes", "\x03 \x03\x02\x14\x05\x01\x01\x05,\x95\x014"},
-	{"crypto/internal/fips140/aes/gcm", "#\x01\x02\x02\x02\x12\x05\x01\x06,\x92\x01"},
-	{"crypto/internal/fips140/alias", "\xd5\x02"},
-	{"crypto/internal/fips140/bigmod", "(\x19\x01\x06,\x95\x01"},
-	{"crypto/internal/fips140/check", "#\x0e\a\t\x02\xb7\x01["},
-	{"crypto/internal/fips140/check/checktest", "(\x8b\x02\""},
-	{"crypto/internal/fips140/drbg", "\x03\x1f\x01\x01\x04\x14\x05\n)\x86\x01\x0f7\x01"},
-	{"crypto/internal/fips140/ecdh", "\x03 \x05\x02\n\r3\x86\x01\x0f7"},
-	{"crypto/internal/fips140/ecdsa", "\x03 \x04\x01\x02\a\x03\x06:\x16pF"},
-	{"crypto/internal/fips140/ed25519", "\x03 \x05\x02\x04\f:\xc9\x01\x03"},
-	{"crypto/internal/fips140/edwards25519", "\x1f\t\a\x123\x95\x017"},
-	{"crypto/internal/fips140/edwards25519/field", "(\x14\x053\x95\x01"},
-	{"crypto/internal/fips140/hkdf", "\x03 \x05\t\a<\x16"},
-	{"crypto/internal/fips140/hmac", "\x03 \x15\x01\x01:\x16"},
-	{"crypto/internal/fips140/mldsa", "\x03\x1c\x04\x05\x02\x0e\x01\x03\x053\x95\x017"},
-	{"crypto/internal/fips140/mlkem", "\x03 \x05\x02\x0f\x03\x053\xcc\x01"},
-	{"crypto/internal/fips140/nistec", "\x1f\t\r\f3\x95\x01*\r\x15"},
-	{"crypto/internal/fips140/nistec/fiat", "(\x148\x95\x01"},
-	{"crypto/internal/fips140/pbkdf2", "\x03 \x05\t\a<\x16"},
-	{"crypto/internal/fips140/rsa", "\x03\x1c\x04\x04\x01\x02\x0e\x01\x01\x028\x16pF"},
-	{"crypto/internal/fips140/sha256", "\x03 \x1e\x01\x06,\x16\x7f"},
-	{"crypto/internal/fips140/sha3", "\x03 \x19\x05\x012\x95\x01L"},
-	{"crypto/internal/fips140/sha512", "\x03 \x1e\x01\x06,\x16\x7f"},
-	{"crypto/internal/fips140/ssh", "(b"},
-	{"crypto/internal/fips140/subtle", "\x1f\a\x1b\xc8\x01"},
-	{"crypto/internal/fips140/tls12", "\x03 \x05\t\a\x02:\x16"},
-	{"crypto/internal/fips140/tls13", "\x03 \x05\b\b\t3\x16"},
-	{"crypto/internal/fips140cache", "\xb3\x02\r'"},
+	{"crypto/internal/cryptotest", "\x03\r\v\t%\x11\x1a\r\x12\x12!\x04\x06\n\x19\x01\x11\x11\x1d\x01\a\x03\x02\b\x02\x01\x05\f"},
+	{"crypto/internal/cryptotest/wycheproof", "\x0e\x12S\x01\f\x01r@\x05\x03\x15\x10"},
+	{"crypto/internal/entropy", "L"},
+	{"crypto/internal/entropy/v1.0.0", "E9\x96\x01:\x14"},
+	{"crypto/internal/fips140", "D:\xc2\x01\v\x17"},
+	{"crypto/internal/fips140/aes", "\x03!\x03\x02\x14\x05\x01\x01\x055\x96\x016"},
+	{"crypto/internal/fips140/aes/gcm", "$\x01\x02\x02\x02\x12\x05\x01\x065\x93\x01"},
+	{"crypto/internal/fips140/alias", "\xe2\x02"},
+	{"crypto/internal/fips140/bigmod", ")\x19\x01\x065\x96\x01"},
+	{"crypto/internal/fips140/check", "$\x0e\a\t\x02\xc1\x01]"},
+	{"crypto/internal/fips140/check/checktest", ")\x97\x02\""},
+	{"crypto/internal/fips140/drbg", "\x03 \x01\x01\x04\x14\x05\n2\x87\x01\x0f9\x01"},
+	{"crypto/internal/fips140/ecdh", "\x03!\x05\x02\n\r<\x87\x01\x0f9"},
+	{"crypto/internal/fips140/ecdsa", "\x03!\x04\x01\x02\a\x03\x06C\x15r\x0f9"},
+	{"crypto/internal/fips140/ed25519", "\x03!\x05\x02\x04\fC\xcc\x01\x03"},
+	{"crypto/internal/fips140/edwards25519", "\x1f\n\a\x12<\x96\x019"},
+	{"crypto/internal/fips140/edwards25519/field", ")\x14\x05<\x96\x01"},
+	{"crypto/internal/fips140/hkdf", "\x03!\x05\t\aE\x15"},
+	{"crypto/internal/fips140/hmac", "\x03!\x15\x01\x01C\x15"},
+	{"crypto/internal/fips140/mldsa", "\x03\x1c\x05\x05\x02\x0e\x01\x03\x05<\x96\x019"},
+	{"crypto/internal/fips140/mlkem", "\x03!\x05\x02\x0f\x03\x05<\xcf\x01"},
+	{"crypto/internal/fips140/nistec", "\x1f\n\r\f<\x96\x01,\r\x15"},
+	{"crypto/internal/fips140/nistec/fiat", ")\x14A\x96\x01"},
+	{"crypto/internal/fips140/pbkdf2", "\x03!\x05\t\aE\x15"},
+	{"crypto/internal/fips140/rsa", "\x03\x1c\x05\x04\x01\x02\x0e\x01\x01\x02A\x15rH"},
+	{"crypto/internal/fips140/sha256", "\x03!\x1e\x01\x065\x15\x81\x01"},
+	{"crypto/internal/fips140/sha3", "\x03!\x19\x05\x01;\x96\x01N"},
+	{"crypto/internal/fips140/sha512", "\x03!\x1e\x01\x065\x15\x81\x01"},
+	{"crypto/internal/fips140/ssh", ")j"},
+	{"crypto/internal/fips140/subtle", "\x1f\b\x1b\xd2\x01"},
+	{"crypto/internal/fips140/tls12", "\x03!\x05\t\a\x02C\x15"},
+	{"crypto/internal/fips140/tls13", "\x03!\x05\b\b\t<\x15"},
+	{"crypto/internal/fips140cache", "\xc0\x02\r."},
 	{"crypto/internal/fips140deps", ""},
-	{"crypto/internal/fips140deps/byteorder", "\xa0\x01"},
-	{"crypto/internal/fips140deps/cpu", "\xb5\x01\a"},
-	{"crypto/internal/fips140deps/godebug", "\xbd\x01"},
-	{"crypto/internal/fips140deps/time", "\xcf\x02"},
-	{"crypto/internal/fips140hash", "9\x1d4\xcb\x01"},
-	{"crypto/internal/fips140only", "\x17\x13\x0e\x01\x01Pp"},
+	{"crypto/internal/fips140deps/byteorder", "\xa9\x01"},
+	{"crypto/internal/fips140deps/cpu", "\xbe\x01\b"},
+	{"crypto/internal/fips140deps/godebug", "\xc7\x01"},
+	{"crypto/internal/fips140deps/time", "\xe2\x02"},
+	{"crypto/internal/fips140hash", ":\x1e;\xcf\x01"},
+	{"crypto/internal/fips140only", "\x17\x14\x0e\x01\x01Xr"},
 	{"crypto/internal/fips140test", ""},
-	{"crypto/internal/impl", "\xbe\x02"},
-	{"crypto/internal/rand", "\x1b\x0f s=["},
-	{"crypto/internal/randutil", "\xfa\x01\x12"},
-	{"crypto/internal/sysrand", "tq! \r\r\x01\x01\r\x06"},
-	{"crypto/internal/sysrand/internal/seccomp", "t"},
-	{"crypto/md5", "\x0e8.\x16\x16i"},
-	{"crypto/mlkem", "\x0e%"},
-	{"crypto/mlkem/mlkemtest", "3\x13\b&"},
-	{"crypto/pbkdf2", "6\x0f\x01.\x16"},
-	{"crypto/rand", "\x1b\x0f\x1c\x03+\x86\x01\rN"},
-	{"crypto/rc4", "& .\xc9\x01"},
-	{"crypto/rsa", "\x0e\r\x01\v\x10\x0e\x01\x03\b\a\x1c\x03\x133=\f\x01"},
-	{"crypto/sha1", "\x0e\r+\x02,\x16\x16\x15T"},
-	{"crypto/sha256", "\x0e\r\x1dR"},
-	{"crypto/sha3", "\x0e+Q\xcb\x01"},
-	{"crypto/sha512", "\x0e\r\x1fP"},
-	{"crypto/subtle", "\x1f\x1d\x9f\x01z"},
-	{"crypto/tls", "\x03\b\x02\x01\x01\x01\x01\x02\x01\x01\x01\x02\x01\x01\x01\t\x01\x18\x01\x0f\x01\x03\x01\x01\x01\x01\x02\x01\x02\x01\x17\x02\x03\x13\x16\x15\b=\x16\x16\r\b\x01\x01\x01\x02\x01\x0e\x06\x02\x01\x0f"},
-	{"crypto/tls/internal/fips140tls", "\x17\xaa\x02"},
-	{"crypto/x509", "\x03\v\x01\x01\x01\x01\x01\x01\x01\x017\x06\x01\x01\x02\x05\x0e\x06\x02\x02\x03F\x03:\x01\x02\b\x01\x01\x02\a\x10\x05\x01\x06\a\b\x02\x01\x02\x0f\x02\x01\x01\x02\x03\x01"},
-	{"crypto/x509/pkix", "j\x06\a\x90\x01H"},
-	{"database/sql", "\x03\nQ\x16\x03\x83\x01\v\a\"\x05\b\x02\x03\x01\x0e\x02\x02\x02"},
-	{"database/sql/driver", "\rg\x03\xb7\x01\x0f\x12"},
-	{"debug/buildinfo", "\x03^\x02\x01\x01\b\a\x03g\x1a\x02\x01+\x0f "},
-	{"debug/dwarf", "\x03j\a\x03\x83\x011\x11\x01\x01"},
-	{"debug/elf", "\x03\x06W\r\a\x03g\x1b\x01\f \x17\x01\x17"},
-	{"debug/gosym", "\x03j\n$\xa1\x01\x01\x01\x02"},
-	{"debug/macho", "\x03\x06W\r\ng\x1c,\x17\x01"},
-	{"debug/pe", "\x03\x06W\r\a\x03g\x1c,\x17\x01\x17"},
-	{"debug/plan9obj", "m\a\x03g\x1c,"},
-	{"embed", "t+B\x19\x01T"},
+	{"crypto/internal/impl", "\xcb\x02"},
+	{"crypto/internal/rand", "\x1b\x10 |>]"},
+	{"crypto/internal/randutil", "\x85\x02\x12"},
+	{"crypto/internal/sysrand", "~r!\"\r\r\x01\x01\r\x06"},
+	{"crypto/internal/sysrand/internal/seccomp", "~"},
+	{"crypto/md5", "\x0e97\x15\x16k"},
+	{"crypto/mldsa", "\x0e%K\x87\x01"},
+	{"crypto/mlkem", "\x0e&"},
+	{"crypto/mlkem/mlkemtest", "4\x13\t."},
+	{"crypto/pbkdf2", "7\x0f\x017\x15"},
+	{"crypto/rand", "\x1b\x10\x1c\x034\x87\x01\rP"},
+	{"crypto/rc4", "' 7\xcc\x01"},
+	{"crypto/rsa", "\x0e\r\x01\f\x10\x0e\x01\x03\t\a$\x03\x124>\f\x01"},
+	{"crypto/sha1", "\x0e\r,\x025\x15\x16\x15V"},
+	{"crypto/sha256", "\x0e\r\x1eZ"},
+	{"crypto/sha3", "\x0e,Y\xcf\x01"},
+	{"crypto/sha512", "\x0e\r X"},
+	{"crypto/subtle", "\x1f\x1e\xa9\x01|"},
+	{"crypto/tls", "\x03\b\x02\x01\x01\x01\x01\x02\x01\x01\x01\x01\x01\x01\x01\x01\n\x01\x18\x01\x0f\x01\x01\x03\x01\x01\x01\x01\x02\x01\x02\x01\x1f\x02\x03\x12\x16\x15\t>\x16\x18\r\b\x01\x01\x01\x02\x01\x0e\x06\x03\x01\x15"},
+	{"crypto/tls/internal/fips140tls", "\x17\xb7\x02"},
+	{"crypto/x509", "\x03\v\x01\x01\x01\x01\x01\x01\x01\x01\x017\x01\x06\x01\x01\x02\x05\x0f\x06\t\x02\x03F\x03;\x01\x02\b\x01\x01\x02\a\x12\x05\x01\x06\a\b\x02\x01\x02\x0f\x02\x01\x01\x02\x04\x01"},
+	{"crypto/x509/pkix", "m\x06\x0e\x91\x019\x11"},
+	{"database/sql", "\x03\nS\x01\x1d\x03\x84\x01\v\a$\x05\b\x02\x03\x01\x0e\x02\x02\x02\x01"},
+	{"database/sql/driver", "\rT\x1d\x03\xba\x01\x0f\x12\a"},
+	{"database/sql/internal", ""},
+	{"debug/buildinfo", "\x03a\x02\x01\x01\b\x0e\x03h\x1a\x02\x01-\x0f "},
+	{"debug/dwarf", "\x03m\x0e\x03\x84\x013\x11\x01\x01"},
+	{"debug/elf", "\x03\x06Z\r\x0e\x03h\x1b\x01\f\"\x17\x01\x17"},
+	{"debug/gosym", "\x03m\x11#\xa5\x01\x01\x01\x02"},
+	{"debug/macho", "\x03\x06Z\r\x11h\x1c.\x17\x01"},
+	{"debug/pe", "\x03\x06Z\r\x0e\x03h\x1c.\x17\x01\x17"},
+	{"debug/plan9obj", "p\x0e\x03h\x1c."},
+	{"embed", "~*D\x19\x01V"},
 	{"embed/internal/embedtest", ""},
 	{"encoding", ""},
-	{"encoding/ascii85", "\xfa\x01C"},
-	{"encoding/asn1", "\x03q\x03g(\x01'\r\x02\x01\x11\x03\x01"},
-	{"encoding/base32", "\xfa\x01A\x02"},
-	{"encoding/base64", "\xa0\x01ZA\x02"},
-	{"encoding/binary", "t\x86\x01\f(\r\x05"},
-	{"encoding/csv", "\x02\x01q\x03\x83\x01D\x13\x02"},
-	{"encoding/gob", "\x02f\x05\a\x03g\x1c\v\x01\x03\x1d\b\x12\x01\x10\x02"},
-	{"encoding/hex", "t\x03\x83\x01A\x03"},
-	{"encoding/json", "\x03\x01d\x04\b\x03\x83\x01\f(\r\x02\x01\x02\x11\x01\x01\x02"},
-	{"encoding/pem", "\x03i\b\x86\x01A\x03"},
-	{"encoding/xml", "\x02\x01e\f\x03\x83\x014\x05\n\x01\x02\x11\x02"},
-	{"errors", "\xd0\x01\x85\x01"},
-	{"expvar", "qLA\b\v\x15\r\b\x02\x03\x01\x12"},
-	{"flag", "h\f\x03\x83\x01,\b\x05\b\x02\x01\x11"},
-	{"fmt", "tF'\x19\f \b\r\x02\x03\x13"},
-	{"go/ast", "\x03\x01s\x0f\x01s\x03)\b\r\x02\x01\x13\x02"},
-	{"go/build", "\x02\x01q\x03\x01\x02\x02\b\x02\x01\x17\x1f\x04\x02\b\x1c\x13\x01+\x01\x04\x01\a\b\x02\x01\x13\x02\x02"},
-	{"go/build/constraint", "t\xc9\x01\x01\x13\x02"},
-	{"go/constant", "w\x10\x7f\x01\x024\x01\x02\x13"},
-	{"go/doc", "\x04s\x01\x05\n=61\x10\x02\x01\x13\x02"},
-	{"go/doc/comment", "\x03t\xc4\x01\x01\x01\x01\x13\x02"},
-	{"go/format", "\x03t\x01\f\x01\x02sD"},
-	{"go/importer", "y\a\x01\x02\x04\x01r9"},
-	{"go/internal/gccgoimporter", "\x02\x01^\x13\x03\x04\f\x01p\x02,\x01\x05\x11\x01\r\b"},
-	{"go/internal/gcimporter", "\x02u\x10\x010\x05\r0,\x15\x03\x02"},
-	{"go/internal/scannerhooks", "\x87\x01"},
-	{"go/internal/srcimporter", "w\x01\x01\v\x03\x01r,\x01\x05\x12\x02\x15"},
-	{"go/parser", "\x03q\x03\x01\x02\b\x04\x01s\x01+\x06\x12"},
-	{"go/printer", "w\x01\x02\x03\ns\f \x15\x02\x01\x02\f\x05\x02"},
-	{"go/scanner", "\x03t\v\x05s2\x10\x01\x14\x02"},
-	{"go/token", "\x04s\x86\x01>\x02\x03\x01\x10\x02"},
-	{"go/types", "\x03\x01\x06j\x03\x01\x03\t\x03\x024\x063\x04\x03\t \x06\a\b\x01\x01\x01\x02\x01\x10\x02\x02"},
-	{"go/version", "\xc2\x01|"},
-	{"hash", "\xfa\x01"},
-	{"hash/adler32", "t\x16\x16"},
-	{"hash/crc32", "t\x16\x16\x15\x8b\x01\x01\x14"},
-	{"hash/crc64", "t\x16\x16\xa0\x01"},
-	{"hash/fnv", "t\x16\x16i"},
-	{"hash/maphash", "\x8a\x01\x11<~"},
-	{"html", "\xbe\x02\x02\x13"},
-	{"html/template", "\x03n\x06\x19-=\x01\n!\x05\x01\x02\x03\f\x01\x02\r\x01\x03\x02"},
-	{"image", "\x02r\x1fg\x0f4\x03\x01"},
+	{"encoding/ascii85", "\x85\x02E"},
+	{"encoding/asn1", "\x03{\x03h(\x01)\r\x02\x01\x11\x03\x01"},
+	{"encoding/base32", "\x85\x02C\x02"},
+	{"encoding/base64", "\xa9\x01\\C\x02"},
+	{"encoding/binary", "~\x87\x01\f*\r\x05"},
+	{"encoding/csv", "\x02\x01{\x03\x84\x01F\x13\x02"},
+	{"encoding/gob", "\x02i\x05\x0e\x03h\x1c\v\x01\x03\x1f\b\x12\x01\x10\x02"},
+	{"encoding/hex", "~\x03\x84\x01C\x03"},
+	{"encoding/json", "\x03\x01g\n\x01\x01\x02\x01\x01\x03\x03\x84\x016\x0f\x01"},
+	{"encoding/json/internal", "~"},
+	{"encoding/json/internal/jsonflags", "u"},
+	{"encoding/json/internal/jsonopts", "u\x01"},
+	{"encoding/json/internal/jsontest", "\x03f\x15\x03\x83\x01\x01\x012\b\b\x03\x02\x0f"},
+	{"encoding/json/internal/jsonwire", "\x04r\b\x87\x01\f7\x02\x01\x13\x01\x01"},
+	{"encoding/json/jsontext", "\x03r\x01\x01\x02\x05\x87\x01\x03\t\x034\x02\x01\x02\x13"},
+	{"encoding/json/v2", "\x03\x01g\x03\x01\x01\x03\x02\x01\x01\x02\x01\x04\x03\x84\x01\f\x03'\r\x02\x01\x02\x0f\x02\x02"},
+	{"encoding/pem", "\x03l\x0f\x87\x01C\x03"},
+	{"encoding/xml", "\x02\x01h\x13\x03\x84\x016\x05\n\x01\x02\x11\x02"},
+	{"errors", "\xdb\x01\x87\x01"},
+	{"expvar", "tSB\b\v\x17\r\b\x02\x03\x01\x12"},
+	{"flag", "k\x13\x03\x84\x01.\b\x05\b\x02\x01\x11"},
+	{"fmt", "~E)\x19\f\"\b\r\x02\x03\x13"},
+	{"go/ast", "\x03\x01}\x0e\x01u\x03+\b\r\x02\x01\x13\x02"},
+	{"go/build", "\x02\x01{\x03\x01\x02\x02\a\x02\x01\x17 \x04\x02\t\x1c\x13\x01-\x01\x04\x01\a\b\x02\x01\x13\x02\x02"},
+	{"go/build/constraint", "~\xcc\x01\x01\x13\x02"},
+	{"go/constant", "\x81\x01\x0f\x81\x01\x01\x026\x01\x02\x13"},
+	{"go/doc", "\x04}\x01\x05\t>73\x10\x02\x01\x13\x02"},
+	{"go/doc/comment", "\x03~\xc7\x01\x01\x01\x01\x13\x02"},
+	{"go/format", "\x03~\x01\v\x01\x02uF"},
+	{"go/importer", "\x83\x01\a\x01\x01\x04\x01t;"},
+	{"go/internal/gccgoimporter", "\x02\x01a\x1a\x03\x04\v\x01r\x02.\x01\x05\x11\x01\r\b"},
+	{"go/internal/gcimporter", "\x02\x7f\x0f\x010\x140.\x15\x03\x02"},
+	{"go/internal/srcimporter", "\x81\x01\x01\x01\n\x03\x01t.\x01\x05\x12\x02\x15"},
+	{"go/parser", "\x03{\x03\x01\x02\v\x01u\x01-\x06\x12"},
+	{"go/printer", "\x81\x01\x01\x02\x03\tu\f\"\x15\x02\x01\x02\f\x05\x02"},
+	{"go/scanner", "\x03~\x0fu4\x10\x01\x14\x02"},
+	{"go/token", "\x04}\x87\x01@\x02\x03\x01\x10\x02"},
+	{"go/types", "\x03\x01\x06t\x03\x01\x03\b\x03\x02\x0654\x04\x03\t\"\x06\a\b\x01\x01\x01\x02\x01\x10\x02\x02"},
+	{"go/version", "\xcc\x01\x7f"},
+	{"hash", "\x85\x02"},
+	{"hash/adler32", "~\x15\x16"},
+	{"hash/crc32", "~\x15\x16\x15\x8f\x01\x01\x14"},
+	{"hash/crc64", "~\x15\x16\xa4\x01"},
+	{"hash/fnv", "~\x15\x16k"},
+	{"hash/maphash", "\x93\x01\x11>\x80\x01"},
+	{"html", "\xcb\x02\x02\x13"},
+	{"html/template", "\x03q\r\x18.>\x01\n#\x05\x01\x02\x03\n\x02\x01\x02\r\x01\x03\x02"},
+	{"image", "\x02|\x1ei\x0f6\x03\x01"},
 	{"image/color", ""},
-	{"image/color/palette", "\x93\x01"},
-	{"image/draw", "\x92\x01\x01\x04"},
-	{"image/gif", "\x02\x01\x05l\x03\x1b\x01\x01\x01\vZ\x0f"},
-	{"image/internal/imageutil", "\x92\x01"},
-	{"image/jpeg", "\x02r\x1e\x01\x04c"},
-	{"image/png", "\x02\ad\n\x13\x02\x06\x01gC"},
-	{"index/suffixarray", "\x03j\a\x86\x01\f+\n\x01"},
-	{"internal/abi", "\xbc\x01\x99\x01"},
-	{"internal/asan", "\xd5\x02"},
-	{"internal/bisect", "\xb3\x02\r\x01"},
-	{"internal/buildcfg", "wHg\x06\x02\x05\n\x01"},
-	{"internal/bytealg", "\xb5\x01\xa0\x01"},
+	{"image/color/palette", "\x9c\x01"},
+	{"image/draw", "\x9b\x01\x01\x04"},
+	{"image/gif", "\x02\x01\x05v\x03\x1a\x01\x01\x01\v\\\x0f"},
+	{"image/internal/imageutil", "\x9b\x01"},
+	{"image/jpeg", "\x02|\x1d\x01\x04e"},
+	{"image/png", "\x02\ag\x11\x12\x02\x06\x01iE"},
+	{"index/suffixarray", "\x03m\x0e\x87\x01\f-\n\x01"},
+	{"internal/abi", "\xc6\x01\x9c\x01"},
+	{"internal/asan", "\xe2\x02"},
+	{"internal/bisect", "\xc0\x02\r\x01"},
+	{"internal/buildcfg", "\x81\x01Hj\x06\x02\x05\n\x01"},
+	{"internal/bytealg", "\xbe\x01\xa4\x01"},
 	{"internal/byteorder", ""},
 	{"internal/cfg", ""},
-	{"internal/cgrouptest", "w[T\x06\x0f\x02\x01\x04\x01"},
-	{"internal/chacha8rand", "\xa0\x01\x15\a\x99\x01"},
+	{"internal/cgrouptest", "\x81\x01\\V\x06\x0f\x02\x01\x04\x01"},
+	{"internal/chacha8rand", "\xa9\x01\x15\b\x9c\x01"},
 	{"internal/copyright", ""},
 	{"internal/coverage", ""},
 	{"internal/coverage/calloc", ""},
-	{"internal/coverage/cfile", "q\x06\x17\x17\x01\x02\x01\x01\x01\x01\x01\x01\x01\"\x02',\x06\a\n\x01\x03\x0e\x06"},
-	{"internal/coverage/cformat", "\x04s.\x04Q\v6\x01\x02\x0e"},
-	{"internal/coverage/cmerge", "w.a"},
-	{"internal/coverage/decodecounter", "m\n.\v\x02H,\x17\x18"},
-	{"internal/coverage/decodemeta", "\x02k\n\x17\x17\v\x02H,"},
-	{"internal/coverage/encodecounter", "\x02k\n.\f\x01\x02F\v!\x15"},
-	{"internal/coverage/encodemeta", "\x02\x01j\n\x13\x04\x17\r\x02F,/"},
-	{"internal/coverage/pods", "\x04s.\x81\x01\x06\x05\n\x02\x01"},
-	{"internal/coverage/rtcov", "\xd5\x02"},
-	{"internal/coverage/slicereader", "m\n\x83\x01["},
-	{"internal/coverage/slicewriter", "w\x83\x01"},
-	{"internal/coverage/stringtab", "w9\x04F"},
+	{"internal/coverage/cfile", "t\r\x16\x17\x01\x02\x01\x01\x01\x01\x01\x01\x01$\x02'.\x06\a\n\x01\x03\x0e\x06"},
+	{"internal/coverage/cformat", "\x04}-\x04S\v8\x01\x02\x0e"},
+	{"internal/coverage/cmerge", "\x81\x01-c"},
+	{"internal/coverage/decodecounter", "p\x11-\v\x02J.\x17\x18"},
+	{"internal/coverage/decodemeta", "\x02n\x11\x16\x17\v\x02J."},
+	{"internal/coverage/encodecounter", "\x02n\x11-\f\x01\x02H\v#\x15"},
+	{"internal/coverage/encodemeta", "\x02\x01m\x11\x12\x04\x17\r\x02H./"},
+	{"internal/coverage/pods", "\x04}-\x85\x01\x06\x05\n\x02\x01"},
+	{"internal/coverage/rtcov", "\xe2\x02"},
+	{"internal/coverage/slicereader", "p\x11\x84\x01]"},
+	{"internal/coverage/slicewriter", "\x81\x01\x84\x01"},
+	{"internal/coverage/stringtab", "\x81\x018\x04H"},
 	{"internal/coverage/test", ""},
 	{"internal/coverage/uleb128", ""},
-	{"internal/cpu", "\xd5\x02"},
-	{"internal/dag", "\x04s\xc4\x01\x03"},
-	{"internal/diff", "\x03t\xc5\x01\x02"},
-	{"internal/exportdata", "\x02\x01q\x03\x02e\x1c,\x01\x05\x11\x01\x02"},
-	{"internal/filepathlite", "t+B\x1a@"},
-	{"internal/fmtsort", "\x04\xaa\x02\r"},
-	{"internal/fuzz", "\x03\nH\x18\x04\x03\x03\x01\f\x036=\f\x03\x1d\x01\x05\x02\x05\n\x01\x02\x01\x01\r\x04\x02"},
+	{"internal/cpu", "\xe2\x02"},
+	{"internal/dag", "\x04}\xc7\x01\x03"},
+	{"internal/diff", "\x03~\xc8\x01\x02"},
+	{"internal/exportdata", "\x02\x01{\x03\x02f\x1c.\x01\x05\x11\x01\x02"},
+	{"internal/filepathlite", "~*D\x1aB"},
+	{"internal/fmtsort", "\x04\xb7\x02\r"},
+	{"internal/fuzz", "\x03\nJ\x19\x04\n\x03\x01\v\x037>\f\x03\x1f\x01\x05\x02\x05\n\x01\x02\x01\x01\r\x04\x02"},
+	{"internal/gate", "\r"},
 	{"internal/goarch", ""},
-	{"internal/godebug", "\x9d\x01!\x82\x01\x01\x14"},
+	{"internal/godebug", "\xa6\x01\"\x85\x01\x01\x14"},
 	{"internal/godebugs", ""},
 	{"internal/goexperiment", ""},
 	{"internal/goos", ""},
-	{"internal/goroot", "\xa6\x02\x01\x05\x12\x02"},
+	{"internal/goroot", "\xb3\x02\x01\x05\x12\x02"},
 	{"internal/gover", "\x04"},
 	{"internal/goversion", ""},
-	{"internal/lazyregexp", "\xa6\x02\v\r\x02"},
-	{"internal/lazytemplate", "\xfa\x01,\x18\x02\r"},
-	{"internal/msan", "\xd5\x02"},
+	{"internal/lazyregexp", "\xb3\x02\v\r\x02"},
+	{"internal/lazytemplate", "\x85\x02.\x18\x02\r"},
+	{"internal/msan", "\xe2\x02"},
+	{"internal/nettest", "\x03\nqG@\f\n\x12\x06\x15\x05\x0f"},
 	{"internal/nettrace", ""},
-	{"internal/obscuretestdata", "l\x8e\x01,"},
-	{"internal/oserror", "t"},
-	{"internal/pkgbits", "\x03R\x18\a\x03\x04\fs\r\x1f\r\n\x01"},
+	{"internal/obscuretestdata", "o\x96\x01."},
+	{"internal/oserror", "~"},
+	{"internal/pkgbits", "\x03T\x19\x0e\x03\x04\vu\r!\r\n\x01"},
 	{"internal/platform", ""},
-	{"internal/poll", "tl\x05\x159\r\x01\x01\r\x06"},
-	{"internal/profile", "\x03\x04m\x03\x83\x017\n\x01\x01\x01\x11"},
+	{"internal/poll", "~m\x05\x15;\r\x01\x01\r\x06"},
+	{"internal/profile", "\x03\x04w\x03\x84\x019\n\x01\x01\x01\x11"},
 	{"internal/profilerecord", ""},
-	{"internal/race", "\x9b\x01\xba\x01"},
-	{"internal/reflectlite", "\x9b\x01!;<\""},
-	{"internal/runtime/atomic", "\xbc\x01\x99\x01"},
-	{"internal/runtime/cgroup", "\x9f\x01=\x04u"},
-	{"internal/runtime/exithook", "\xd1\x01\x84\x01"},
-	{"internal/runtime/gc", "\xbc\x01"},
-	{"internal/runtime/gc/internal/gen", "\nc\n\x18k\x04\v\x1d\b\x10\x02"},
-	{"internal/runtime/gc/scan", "\xb5\x01\a\x18\az"},
-	{"internal/runtime/maps", "\x9b\x01\x01 \n\t\t\x03z"},
-	{"internal/runtime/math", "\xbc\x01"},
+	{"internal/race", "\xa4\x01\xbe\x01"},
+	{"internal/reflectlite", "\xa4\x01\"<>\""},
+	{"internal/runtime/atomic", "\xc6\x01\x9c\x01"},
+	{"internal/runtime/cgroup", "\xa8\x01?\x04w"},
+	{"internal/runtime/exithook", "\xdc\x01\x86\x01"},
+	{"internal/runtime/gc", "\xc6\x01"},
+	{"internal/runtime/gc/internal/gen", "\nf\x11\x17m\x04\v\x1f\b\x10\x02"},
+	{"internal/runtime/gc/scan", "\xbe\x01\b\x19\a|"},
+	{"internal/runtime/maps", "\xa4\x01\x01\x04\x15\b\x03\a\n\t\x03.N"},
+	{"internal/runtime/math", "\xc6\x01"},
 	{"internal/runtime/pprof/label", ""},
 	{"internal/runtime/startlinetest", ""},
-	{"internal/runtime/sys", "\xbc\x01\x04"},
-	{"internal/runtime/syscall/linux", "\xbc\x01\x99\x01"},
+	{"internal/runtime/sys", "\xc6\x01\x04"},
+	{"internal/runtime/syscall/linux", "\xc6\x01\x9c\x01"},
 	{"internal/runtime/wasitest", ""},
-	{"internal/saferio", "\xfa\x01["},
-	{"internal/singleflight", "\xc0\x02"},
-	{"internal/strconv", "\x89\x02L"},
-	{"internal/stringslite", "\x9f\x01\xb6\x01"},
-	{"internal/sync", "\x9b\x01!\x13r\x14"},
-	{"internal/synctest", "\x9b\x01\xba\x01"},
-	{"internal/syscall/execenv", "\xc2\x02"},
-	{"internal/syscall/unix", "\xb3\x02\x0e\x01\x13"},
-	{"internal/sysinfo", "\x02\x01\xb2\x01E,\x18\x02"},
+	{"internal/saferio", "\x85\x02]"},
+	{"internal/singleflight", "\xcd\x02"},
+	{"internal/strconv", "\x94\x02N"},
+	{"internal/stringslite", "\xa8\x01\xba\x01"},
+	{"internal/sync", "\xa4\x01\"\x14t\x14"},
+	{"internal/synctest", "\xa4\x01\xbe\x01"},
+	{"internal/syscall/execenv", "\xcf\x02"},
+	{"internal/syscall/unix", "\xeb\x01U\x0e\x01\x13"},
+	{"internal/sysinfo", "\x02\x01\xbb\x01G.\x18\x02"},
 	{"internal/syslist", ""},
-	{"internal/testenv", "\x03\ng\x02\x01*\x1b\x0f0+\x01\x05\a\n\x01\x02\x02\x01\f"},
-	{"internal/testhash", "\x03\x87\x01p\x118\f"},
-	{"internal/testlog", "\xc0\x02\x01\x14"},
-	{"internal/testpty", "t\x03\xaf\x01"},
-	{"internal/trace", "\x02\x01\x01\x06c\a\x03w\x03\x03\x06\x03\t+\n\x01\x01\x01\x11\x06"},
-	{"internal/trace/internal/testgen", "\x03j\nu\x03\x02\x03\x011\v\r\x11"},
-	{"internal/trace/internal/tracev1", "\x03\x01i\a\x03}\x06\f5\x01"},
-	{"internal/trace/raw", "\x02k\nz\x03\x06C\x01\x13"},
-	{"internal/trace/testtrace", "\x02\x01q\x03q\x04\x03\x05\x01\x05,\v\x02\b\x02\x01\x05"},
+	{"internal/testenv", "\x03\nq\x02\x01)\x1c\x100-\x01\x05\a\n\x01\x02\x02\x01\f"},
+	{"internal/testhash", "\x03\x90\x01r\x11:\f"},
+	{"internal/testlog", "\xcd\x02\x01\x14"},
+	{"internal/testpty", "~\x03\xb2\x01"},
+	{"internal/trace", "\x02\x01\x01\x06f\x0e\x03x\x03\x03\x06\x03\t-\n\x01\x01\x01\x11\x06"},
+	{"internal/trace/internal/testgen", "\x03m\x11v\x03\x02\x03\x013\v\r\x11"},
+	{"internal/trace/internal/tracev1", "\x03\x01l\x0e\x03~\x06\f7\x01"},
+	{"internal/trace/raw", "\x02n\x11{\x03\x06E\x01\x13"},
+	{"internal/trace/testtrace", "\x02\x01{\x03r\x04\x03\x05\x01\x05.\v\x02\b\x02\x01\x05"},
 	{"internal/trace/tracev2", ""},
-	{"internal/trace/traceviewer", "\x02d\v\x06\x1a<\x1f\a\a\x04\b\v\x15\x01\x05\a\n\x01\x02\x0f"},
+	{"internal/trace/traceviewer", "\x02g\v\r\x19>\x1f\a\a\x04\b\v\x17\x01\x05\a\n\x01\x02\x0f"},
 	{"internal/trace/traceviewer/format", ""},
-	{"internal/trace/version", "wz\t"},
-	{"internal/txtar", "\x03t\xaf\x01\x18"},
-	{"internal/types/errors", "\xbd\x02"},
-	{"internal/unsafeheader", "\xd5\x02"},
-	{"internal/xcoff", "`\r\a\x03g\x1c,\x17\x01"},
-	{"internal/zstd", "m\a\x03\x83\x01\x0f"},
-	{"io", "t\xcc\x01"},
-	{"io/fs", "t+*11\x10\x14\x04"},
-	{"io/ioutil", "\xfa\x01\x01+\x15\x03"},
-	{"iter", "\xcf\x01d\""},
-	{"log", "w\x83\x01\x05'\r\r\x01\x0e"},
+	{"internal/trace/version", "\x81\x01{\t"},
+	{"internal/txtar", "\x03~\xb2\x01\x18"},
+	{"internal/types/errors", "\xca\x02"},
+	{"internal/unsafeheader", "\xe2\x02"},
+	{"internal/xcoff", "c\r\x0e\x03h\x1c.\x17\x01"},
+	{"internal/zstd", "p\x0e\x03\x84\x01\x0f"},
+	{"io", "~\xcf\x01"},
+	{"io/fs", "~*,13\x10\x14\x04"},
+	{"io/ioutil", "\x85\x02\x01-\x15\x03"},
+	{"iter", "\xda\x01f\""},
+	{"log", "\x81\x01\x84\x01\x05)\r\r\x01\x0e"},
 	{"log/internal", ""},
-	{"log/slog", "\x03\n[\t\x03\x03\x83\x01\x04\x01\x02\x02\x03(\x05\b\x02\x01\x02\x01\x0e\x02\x02\x02"},
+	{"log/slog", "\x03\n^\t\n\x03H<\x04\x01\x02\x02\x03*\x05\b\x02\x01\x02\x01\x0e\x02\x02\x02"},
 	{"log/slog/internal", ""},
-	{"log/slog/internal/benchmarks", "\rg\x03\x83\x01\x06\x03:\x12"},
-	{"log/slog/internal/buffer", "\xc0\x02"},
-	{"log/syslog", "t\x03\x87\x01\x12\x16\x18\x02\x0f"},
-	{"maps", "\xfd\x01X"},
-	{"math", "\xb5\x01TL"},
-	{"math/big", "\x03q\x03)\x15E\f\x03\x020\x02\x01\x02\x15"},
-	{"math/big/internal/asmgen", "\x03\x01s\x92\x012\x03"},
-	{"math/bits", "\xd5\x02"},
-	{"math/cmplx", "\x86\x02\x03"},
-	{"math/rand", "\xbd\x01I:\x01\x14"},
-	{"math/rand/v2", "t,\x03c\x03L"},
-	{"mime", "\x02\x01i\b\x03\x83\x01\v!\x15\x03\x02\x11\x02"},
-	{"mime/multipart", "\x02\x01N#\x03F=\v\x01\a\x02\x15\x02\x06\x0f\x02\x01\x17"},
-	{"mime/quotedprintable", "\x02\x01t\x83\x01"},
-	{"net", "\x04\tg+\x1e\n\x05\x13\x01\x01\x04\x15\x01%\x06\r\b\x05\x01\x01\r\x06\a"},
-	{"net/http", "\x02\x01\x03\x01\x04\x02D\b\x13\x01\a\x03F=\x01\x03\a\x01\x03\x02\x02\x01\x02\x06\x02\x01\x01\n\x01\x01\x05\x01\x02\x05\b\x01\x01\x01\x02\x01\x0e\x02\x02\x02\b\x01\x01\x01"},
-	{"net/http/cgi", "\x02W\x1b\x03\x83\x01\x04\a\v\x01\x13\x01\x01\x01\x04\x01\x05\x02\b\x02\x01\x11\x0e"},
-	{"net/http/cookiejar", "\x04p\x03\x99\x01\x01\b\a\x05\x16\x03\x02\x0f\x04"},
-	{"net/http/fcgi", "\x02\x01\n`\a\x03\x83\x01\x16\x01\x01\x14\x18\x02\x0f"},
-	{"net/http/httptest", "\x02\x01\nL\x02\x1b\x01\x83\x01\x04\x12\x01\n\t\x02\x17\x01\x02\x0f\x0e"},
-	{"net/http/httptrace", "\rLnI\x14\n!"},
-	{"net/http/httputil", "\x02\x01\ng\x03\x83\x01\x04\x0f\x03\x01\x05\x02\x01\v\x01\x19\x02\x01\x0e\x0e"},
-	{"net/http/internal", "\x02\x01q\x03\x83\x01"},
-	{"net/http/internal/ascii", "\xbe\x02\x13"},
-	{"net/http/internal/httpcommon", "\rg\x03\x9f\x01\x0e\x01\x17\x01\x01\x02\x1d\x02"},
-	{"net/http/internal/testcert", "\xbe\x02"},
-	{"net/http/pprof", "\x02\x01\nj\x19-\x02\x0e-\x04\x13\x14\x01\r\x04\x03\x01\x02\x01\x11"},
+	{"log/slog/internal/benchmarks", "\rq\x03\x84\x01\x06\x03<\x12"},
+	{"log/slog/internal/buffer", "\xcd\x02"},
+	{"log/syslog", "~\x03\x88\x01\x12\x18\x18\x02\x0f"},
+	{"maps", "\x88\x02Z"},
+	{"math", "\xbe\x01VN"},
+	{"math/big", "\x03{\x03(\x15G\f\x03\x022\x02\x01\x02\x15"},
+	{"math/big/internal/asmgen", "\x03\x01}\x93\x014\x03"},
+	{"math/bits", "\xe2\x02"},
+	{"math/cmplx", "\x91\x02\x03"},
+	{"math/rand", "\xc7\x01J<\x01\x14"},
+	{"math/rand/v2", "~+\x03e\x03N"},
+	{"mime", "\x02\x01l\x0f\x03\x84\x01\v#\x15\x03\x02\x11\x02"},
+	{"mime/multipart", "\x02\x01P+\x03F>\v\x01\a\x02\x17\x02\x06\x0f\x02\x01\x17"},
+	{"mime/quotedprintable", "\x02\x01~\x84\x01"},
+	{"net", "\x04\tq*\x1f\v\x05\x13\x01\x01\x04\x15\x01'\x06\r\b\x05\x01\x01\r\x06\t"},
+	{"net/http", "\x02\x01\x03\x01\x04\x02N\x14\x0f\x03F>\x01\x03\a\x01\x06\x01\x01\x02\x06\x02\x01\x01\f\x01\x01\x05\x01\x02\x05\b\x01\x01\x01\x02\x01\x0e\x02\x02\x02\n\x01\x03"},
+	{"net/http/cgi", "\x02Y#\x03\x84\x01\x04\a\v\x01\x15\x01\x01\x01\x04\x01\x05\x02\b\x02\x01\x11\x10"},
+	{"net/http/cookiejar", "\x04z\x03\x9a\x01\x01\b\t\x05\x16\x03\x02\x0f\x04"},
+	{"net/http/fcgi", "\x02\x01\nc\x0e\x03\x84\x01\x16\x01\x01\x16\x18\x02\x0f"},
+	{"net/http/httptest", "\x02\x01\nN\x02#\x01P4\x04\x12\x01\f\t\x02\r\n\x01\x02\x03\f\x06\n"},
+	{"net/http/httptrace", "\rNwI\x16+"},
+	{"net/http/httputil", "\x02\x01\nq\x03F>\x04\x0f\x03\x01\x05\x02\x01\r\x01\x19\x02\x01\x0e\x10"},
+	{"net/http/internal", "\x02\x01m\x0e\x03\x84\x01"},
+	{"net/http/internal/ascii", "\xcb\x02\x13"},
+	{"net/http/internal/http2", "\x02\x01\x03\x01\x06F\b\x15\x0e\x03\x84\x01\x01\x03\b\x03\x02\x03\x02\x06\x02\x03\x01\n\x01\x01\b\x05\b\x02\x01\x02\x01\x0e\x10\x02\x02"},
+	{"net/http/internal/httpcommon", "\rq\x03\xa0\x01\x10\x01\x17\x01\x01\x02\x1f\x02"},
+	{"net/http/internal/httpsfv", "\xc8\x02\x02\x01\x11\x04"},
+	{"net/http/internal/testcert", "\xcb\x02"},
+	{"net/http/pprof", "\x02\x01\nt\x18.\x11-\x04\x13\x16\x01\r\x04\x03\x01\x02\x01\x11"},
 	{"net/internal/cgotest", ""},
-	{"net/internal/socktest", "w\xc9\x01\x02"},
-	{"net/mail", "\x02r\x03\x83\x01\x04\x0f\x03\x14\x1a\x02\x0f\x04"},
-	{"net/netip", "\x04p+\x01f\x034\x17"},
-	{"net/rpc", "\x02m\x05\x03\x10\ni\x04\x12\x01\x1d\r\x03\x02"},
-	{"net/rpc/jsonrpc", "q\x03\x03\x83\x01\x16\x11\x1f"},
-	{"net/smtp", "\x194\f\x13\b\x03\x83\x01\x16\x14\x1a"},
-	{"net/textproto", "\x02\x01q\x03\x83\x01\f\n-\x01\x02\x15"},
-	{"net/url", "t\x03Fc\v\x10\x02\x01\x17"},
-	{"os", "t+\x01\x19\x03\x10\x14\x01\x03\x01\x05\x10\x018\b\x05\x01\x01\r\x06"},
-	{"os/exec", "\x03\ngI'\x01\x15\x01+\x06\a\n\x01\x03\x01\r"},
-	{"os/exec/internal/fdtest", "\xc2\x02"},
-	{"os/signal", "\r\x99\x02\x15\x05\x02"},
-	{"os/user", "\x02\x01q\x03\x83\x01,\r\n\x01\x02"},
-	{"path", "t+\xb4\x01"},
-	{"path/filepath", "t+\x1aB+\r\b\x03\x04\x11"},
-	{"plugin", "t"},
-	{"reflect", "t'\x04\x1d\x13\b\x04\x05\x17\x06\t-\n\x03\x11\x02\x02"},
+	{"net/internal/socktest", "\x81\x01\xcc\x01\x02"},
+	{"net/mail", "\x02|\x03\x84\x01\x04\x0f\x03\x16\x1a\x02\x0f\x04"},
+	{"net/netip", "\x04z*\x01h\x036\x17"},
+	{"net/rpc", "\x02p\f\x03\x0f\nk\x04\x12\x01\x1f\r\x03\x02"},
+	{"net/rpc/jsonrpc", "t\n\x03\x84\x01\x16\x13\x1f"},
+	{"net/smtp", "\x195\r\x14\x0f\x03\x84\x01\x16\x16\x1a"},
+	{"net/textproto", "\x02\x01{\x03\x84\x01\f\n/\x01\x02\x15"},
+	{"net/url", "~\x03Ff\v\x10\x02\x01\x17"},
+	{"os", "~*\x01\x19\x04\x11\x14\x01\x03\x01\x05\x10\x01:\b\x05\x01\x01\r\x06"},
+	{"os/exec", "\x03\nqI(\x01\x15\x01-\x06\a\n\x01\x03\x01\r"},
+	{"os/exec/internal/fdtest", "\xcf\x02"},
+	{"os/signal", "\r\xa6\x02\x15\x05\x02"},
+	{"os/user", "\x02\x01{\x03\x84\x01.\r\n\x01\x02"},
+	{"path", "~*\xb8\x01"},
+	{"path/filepath", "~*\x1aD-\r\b\x03\x04\x11"},
+	{"plugin", "~"},
+	{"reflect", "~&\x04\x1e\x03\x11\b\x04\x05\x17\x06\t/\n\x03\x11\x02\x02"},
 	{"reflect/internal/example1", ""},
 	{"reflect/internal/example2", ""},
-	{"regexp", "\x03\xf7\x018\t\x02\x01\x02\x11\x02"},
-	{"regexp/syntax", "\xbb\x02\x01\x01\x01\x02\x11\x02"},
-	{"runtime", "\x9b\x01\x04\x01\x03\f\x06\a\x02\x01\x01\x0e\x03\x01\x01\x01\x02\x01\x01\x01\x02\x01\x04\x01\x10\x18L"},
-	{"runtime/coverage", "\xa7\x01S"},
-	{"runtime/debug", "wUZ\r\b\x02\x01\x11\x06"},
-	{"runtime/metrics", "\xbe\x01H-\""},
-	{"runtime/pprof", "\x02\x01\x01\x03\x06`\a\x03$$\x0f\v!\f \r\b\x01\x01\x01\x02\x02\n\x03\x06"},
-	{"runtime/race", "\xb9\x02"},
+	{"regexp", "\x03\x82\x02\x037\t\x02\x01\x02\x11\x02"},
+	{"regexp/syntax", "\xc8\x02\x01\x01\x01\x02\x11\x02"},
+	{"runtime", "\xa4\x01\x04\x01\x03\f\x06\b\x02\x01\x01\x0f\x03\x01\x01\x01\x02\x01\x01\x01\x02\x01\x04\x01\x10\x18N"},
+	{"runtime/coverage", "\xb0\x01U"},
+	{"runtime/debug", "\x81\x01V\\\r\b\x02\x01\x11\x06"},
+	{"runtime/metrics", "\xc8\x01I/\""},
+	{"runtime/pprof", "\x02\x01\x01\x03\x06c\x0e\x03#5\v!\f\"\r\b\x01\x01\x01\x02\x02\n\x03\x06"},
+	{"runtime/race", "\xc6\x02"},
 	{"runtime/race/internal/amd64v1", ""},
-	{"runtime/trace", "\rg\x03z\t9\b\x05\x01\x0e\x06"},
-	{"slices", "\x04\xf9\x01\fL"},
-	{"sort", "\xd0\x0192"},
-	{"strconv", "t+A\x01r"},
-	{"strings", "t'\x04B\x19\x03\f7\x11\x02\x02"},
+	{"runtime/trace", "\rq\x03{\t;\b\x05\x01\x0e\x06"},
+	{"slices", "\x04\x84\x02\fN"},
+	{"sort", "\xdb\x0194"},
+	{"strconv", "~*C\x01t"},
+	{"strings", "~&\x04D\x19\x03\f9\x11\x02\x02"},
 	{"structs", ""},
-	{"sync", "\xcf\x01\x13\x01P\x0e\x14"},
-	{"sync/atomic", "\xd5\x02"},
-	{"syscall", "t(\x03\x01\x1c\n\x03\x06\r\x04S\b\x05\x01\x14"},
-	{"testing", "\x03\ng\x02\x01X\x17\x14\f\x05\x1b\x06\x02\x05\x02\x05\x01\x02\x01\x02\x01\x0e\x02\x04"},
-	{"testing/cryptotest", "QOZ\x124\x03\x12"},
-	{"testing/fstest", "t\x03\x83\x01\x01\n&\x10\x03\t\b"},
-	{"testing/internal/testdeps", "\x02\v\xae\x01/\x10,\x03\x05\x03\x06\a\x02\x0f"},
-	{"testing/iotest", "\x03q\x03\x83\x01\x04"},
-	{"testing/quick", "v\x01\x8f\x01\x05#\x10\x11"},
-	{"testing/slogtest", "\rg\x03\x89\x01.\x05\x10\f"},
-	{"testing/synctest", "\xe3\x01`\x12"},
-	{"text/scanner", "\x03t\x83\x01,+\x02"},
-	{"text/tabwriter", "w\x83\x01Y"},
-	{"text/template", "t\x03C@\x01\n \x01\x05\x01\x02\x05\v\x02\x0e\x03\x02"},
-	{"text/template/parse", "\x03t\xbc\x01\n\x01\x13\x02"},
-	{"time", "t+\x1e$(*\r\x02\x13"},
-	{"time/tzdata", "t\xce\x01\x13"},
+	{"sync", "\xda\x01\x02\x11\x01R\x0e\x14"},
+	{"sync/atomic", "\xe2\x02"},
+	{"syscall", "~'\x03\x01\x1d\n\x04\x06\r\x04U\b\x05\x01\x14"},
+	{"testing", "\x03\nq\x02\x01Y\x17\x14\f\x05\x1d\x06\x02\x05\x02\x05\x01\x02\x01\x02\x01\x0e\x02\x04"},
+	{"testing/cryptotest", "SV\\\x126\x03\x12"},
+	{"testing/fstest", "~\x03\x84\x01\x01\n(\x10\x03\t\b"},
+	{"testing/internal/testdeps", "\x02\v\xb7\x011\x10.\x03\x05\x03\x06\a\x02\x0f"},
+	{"testing/iotest", "\x03{\x03\x84\x01\x04"},
+	{"testing/quick", "\x80\x01\x01\x90\x01\x05%\x10\x11"},
+	{"testing/slogtest", "\rq\x03\x8a\x010\x05\x10\f"},
+	{"testing/synctest", "\xee\x01b\f\x06"},
+	{"text/scanner", "\x03~\x84\x01.+\x02"},
+	{"text/tabwriter", "\x81\x01\x84\x01["},
+	{"text/template", "~\x03BB\x01\n\"\x01\x05\x01\x02\x05\v\x02\x0e\x03\x02"},
+	{"text/template/parse", "\x03~\xbf\x01\n\x01\x13\x02"},
+	{"time", "~*D(,\r\x02\x13"},
+	{"time/tzdata", "~\xd1\x01\x13"},
 	{"unicode", ""},
 	{"unicode/utf16", ""},
 	{"unicode/utf8", ""},
-	{"unique", "\x9b\x01!%\x01Q\r\x01\x14\x12"},
+	{"unique", "\xa4\x01\"&\x01S\r\x01\x14\x19"},
 	{"unsafe", ""},
-	{"vendor/golang.org/x/crypto/chacha20", "\x10]\a\x95\x01*'"},
-	{"vendor/golang.org/x/crypto/chacha20poly1305", "\x10\aV\a\xe2\x01\x04\x01\a"},
-	{"vendor/golang.org/x/crypto/cryptobyte", "j\n\x03\x90\x01'!\n"},
+	{"uuid", "\x03\x01O\x1d\x03\v\xcf\x01\x0f"},
+	{"vendor/golang.org/x/crypto/chacha20", "\x10`\x0e\x96\x01,)"},
+	{"vendor/golang.org/x/crypto/chacha20poly1305", "\x10\aY\x0e\xe6\x01\x05\x01\f"},
+	{"vendor/golang.org/x/crypto/cryptobyte", "m\x11\x03\x91\x01)!\v"},
 	{"vendor/golang.org/x/crypto/cryptobyte/asn1", ""},
-	{"vendor/golang.org/x/crypto/internal/alias", "\xd5\x02"},
-	{"vendor/golang.org/x/crypto/internal/poly1305", "X\x15\x9c\x01"},
-	{"vendor/golang.org/x/net/dns/dnsmessage", "t\xc7\x01"},
-	{"vendor/golang.org/x/net/http/httpguts", "\x90\x02\x14\x1a\x15\r"},
-	{"vendor/golang.org/x/net/http/httpproxy", "t\x03\x99\x01\x10\x05\x01\x18\x15\r"},
-	{"vendor/golang.org/x/net/http2/hpack", "\x03q\x03\x83\x01F"},
-	{"vendor/golang.org/x/net/idna", "w\x8f\x018\x15\x10\x02\x01"},
-	{"vendor/golang.org/x/net/nettest", "\x03j\a\x03\x83\x01\x11\x05\x16\x01\f\n\x01\x02\x02\x01\f"},
-	{"vendor/golang.org/x/sys/cpu", "\xa6\x02\r\n\x01\x17"},
-	{"vendor/golang.org/x/text/secure/bidirule", "t\xdf\x01\x11\x01"},
-	{"vendor/golang.org/x/text/transform", "\x03q\x86\x01Y"},
-	{"vendor/golang.org/x/text/unicode/bidi", "\x03\bl\x87\x01>\x17"},
-	{"vendor/golang.org/x/text/unicode/norm", "m\n\x83\x01F\x13\x11"},
-	{"weak", "\x9b\x01\x98\x01\""},
+	{"vendor/golang.org/x/crypto/hkdf", "\x18\x01e\x15r"},
+	{"vendor/golang.org/x/crypto/internal/alias", "\xe2\x02"},
+	{"vendor/golang.org/x/crypto/internal/poly1305", "Z\x16\xa4\x01"},
+	{"vendor/golang.org/x/net/dns/dnsmessage", "~\xca\x01"},
+	{"vendor/golang.org/x/net/http/httpguts", "\x9b\x02\x16\x1a\x15\x10"},
+	{"vendor/golang.org/x/net/http/httpproxy", "~\x03\x9a\x01\x12\x05\x01\x18\x15\x10"},
+	{"vendor/golang.org/x/net/http2/hpack", "\x03{\x03\x84\x01H"},
+	{"vendor/golang.org/x/net/http3", "\x9c\x02@\x06\x0f\x04"},
+	{"vendor/golang.org/x/net/idna", "\x81\x01\x90\x01:\x13\x02\x17\x02\x01"},
+	{"vendor/golang.org/x/net/internal/http3", "\rN#\x03\x84\x01\v\x04\a\x01\x05\x10\x01\x16\x02\x01\x02\x0f\x10\x02\x04\x03"},
+	{"vendor/golang.org/x/net/internal/httpcommon", "\rq\x03\xa0\x01\x10\x01\x17\x01\x01\x02\x1f\x02"},
+	{"vendor/golang.org/x/net/internal/quic/quicwire", "p"},
+	{"vendor/golang.org/x/net/nettest", "\x03m\x0e\x03\x84\x01\x11\x05\x18\x01\f\n\x01\x02\x02\x01\f"},
+	{"vendor/golang.org/x/net/quic", "\x03\n\x01\x01\x01\t:\x04\x04\x15\x03\v\x03\x12r\x06\x06\x06\x04\x12\x06\x15\x02\x01\x02\x01\x01\r\x06\x02\x01\x01\x02\v"},
+	{"vendor/golang.org/x/sys/cpu", "\xb3\x02\r\n\x01\x17"},
+	{"vendor/golang.org/x/text/secure/bidirule", "~\xe2\x01\x18\x01"},
+	{"vendor/golang.org/x/text/transform", "\x03{\x87\x01["},
+	{"vendor/golang.org/x/text/unicode/bidi", "\x03\bv\x88\x01@\x17"},
+	{"vendor/golang.org/x/text/unicode/norm", "p\x11\x84\x01H\x13\x18"},
+	{"weak", "\xa4\x01\x9c\x01\""},
 }
 
 // bootstrap is the list of bootstrap packages extracted from cmd/dist.
@@ -408,6 +428,7 @@
 	"cmd/compile/internal/logopt":             true,
 	"cmd/compile/internal/loong64":            true,
 	"cmd/compile/internal/loopvar":            true,
+	"cmd/compile/internal/midway":             true,
 	"cmd/compile/internal/mips":               true,
 	"cmd/compile/internal/mips64":             true,
 	"cmd/compile/internal/noder":              true,
@@ -512,6 +533,7 @@
 	"internal/race":                           true,
 	"internal/runtime/gc":                     true,
 	"internal/saferio":                        true,
+	"internal/strconv":                        true,
 	"internal/syscall/unix":                   true,
 	"internal/types/errors":                   true,
 	"internal/unsafeheader":                   true,
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/tools/internal/stdlib/manifest.go /work/src/external-provisioner/vendor/golang.org/x/tools/internal/stdlib/manifest.go
--- a/vendor/golang.org/x/tools/internal/stdlib/manifest.go	2026-09-05 00:02:32.214805055 +0000
+++ b/vendor/golang.org/x/tools/internal/stdlib/manifest.go	2026-09-05 00:03:04.622980661 +0000
@@ -270,6 +270,7 @@
 		{"ContainsRune", Func, 7, "func(b []byte, r rune) bool"},
 		{"Count", Func, 0, "func(s []byte, sep []byte) int"},
 		{"Cut", Func, 18, "func(s []byte, sep []byte) (before []byte, after []byte, found bool)"},
+		{"CutLast", Func, 27, "func(s []byte, sep []byte) (before []byte, after []byte, found bool)"},
 		{"CutPrefix", Func, 20, "func(s []byte, prefix []byte) (after []byte, found bool)"},
 		{"CutSuffix", Func, 20, "func(s []byte, suffix []byte) (before []byte, found bool)"},
 		{"Equal", Func, 0, "func(a []byte, b []byte) bool"},
@@ -538,6 +539,7 @@
 		{"MD4", Const, 0, ""},
 		{"MD5", Const, 0, ""},
 		{"MD5SHA1", Const, 0, ""},
+		{"MLDSAMu", Const, 27, ""},
 		{"MessageSigner", Type, 25, ""},
 		{"PrivateKey", Type, 0, ""},
 		{"PublicKey", Type, 2, ""},
@@ -812,6 +814,40 @@
 		{"Size", Const, 0, ""},
 		{"Sum", Func, 2, "func(data []byte) [16]byte"},
 	},
+	"crypto/mldsa": {
+		{"(*Options).HashFunc", Method, 27, ""},
+		{"(*PrivateKey).Bytes", Method, 27, ""},
+		{"(*PrivateKey).Equal", Method, 27, ""},
+		{"(*PrivateKey).Public", Method, 27, ""},
+		{"(*PrivateKey).PublicKey", Method, 27, ""},
+		{"(*PrivateKey).Sign", Method, 27, ""},
+		{"(*PrivateKey).SignDeterministic", Method, 27, ""},
+		{"(*PublicKey).Bytes", Method, 27, ""},
+		{"(*PublicKey).Equal", Method, 27, ""},
+		{"(*PublicKey).Parameters", Method, 27, ""},
+		{"(Parameters).PublicKeySize", Method, 27, ""},
+		{"(Parameters).SignatureSize", Method, 27, ""},
+		{"(Parameters).String", Method, 27, ""},
+		{"GenerateKey", Func, 27, "func(params Parameters) (*PrivateKey, error)"},
+		{"MLDSA44", Func, 27, "func() Parameters"},
+		{"MLDSA44PublicKeySize", Const, 27, ""},
+		{"MLDSA44SignatureSize", Const, 27, ""},
+		{"MLDSA65", Func, 27, "func() Parameters"},
+		{"MLDSA65PublicKeySize", Const, 27, ""},
+		{"MLDSA65SignatureSize", Const, 27, ""},
+		{"MLDSA87", Func, 27, "func() Parameters"},
+		{"MLDSA87PublicKeySize", Const, 27, ""},
+		{"MLDSA87SignatureSize", Const, 27, ""},
+		{"NewPrivateKey", Func, 27, "func(params Parameters, seed []byte) (*PrivateKey, error)"},
+		{"NewPublicKey", Func, 27, "func(params Parameters, encoding []byte) (*PublicKey, error)"},
+		{"Options", Type, 27, ""},
+		{"Options.Context", Field, 27, ""},
+		{"Parameters", Type, 27, ""},
+		{"PrivateKey", Type, 27, ""},
+		{"PrivateKeySize", Const, 27, ""},
+		{"PublicKey", Type, 27, ""},
+		{"Verify", Func, 27, "func(pk *PublicKey, message []byte, signature []byte, opts *Options) error"},
+	},
 	"crypto/mlkem": {
 		{"(*DecapsulationKey1024).Bytes", Method, 24, ""},
 		{"(*DecapsulationKey1024).Decapsulate", Method, 24, ""},
@@ -1120,6 +1156,7 @@
 		{"ConnectionState.ECHAccepted", Field, 23, ""},
 		{"ConnectionState.HandshakeComplete", Field, 0, ""},
 		{"ConnectionState.HelloRetryRequest", Field, 26, ""},
+		{"ConnectionState.LocalCertificate", Field, 27, ""},
 		{"ConnectionState.NegotiatedProtocol", Field, 0, ""},
 		{"ConnectionState.NegotiatedProtocolIsMutual", Field, 0, ""},
 		{"ConnectionState.OCSPResponse", Field, 5, ""},
@@ -1152,6 +1189,10 @@
 		{"InsecureCipherSuites", Func, 14, "func() []*CipherSuite"},
 		{"Listen", Func, 0, "func(network string, laddr string, config *Config) (net.Listener, error)"},
 		{"LoadX509KeyPair", Func, 0, "func(certFile string, keyFile string) (Certificate, error)"},
+		{"MLDSA44", Const, 27, ""},
+		{"MLDSA65", Const, 27, ""},
+		{"MLDSA87", Const, 27, ""},
+		{"MLKEM1024", Const, 27, ""},
 		{"NewLRUClientSessionCache", Func, 3, "func(capacity int) ClientSessionCache"},
 		{"NewListener", Func, 0, "func(inner net.Listener, config *Config) net.Listener"},
 		{"NewResumptionState", Func, 21, "func(ticket []byte, state *SessionState) (*ClientSessionState, error)"},
@@ -1166,6 +1207,7 @@
 		{"ParseSessionState", Func, 21, "func(data []byte) (*SessionState, error)"},
 		{"QUICClient", Func, 21, "func(config *QUICConfig) *QUICConn"},
 		{"QUICConfig", Type, 21, ""},
+		{"QUICConfig.ClientHelloInfoConn", Field, 27, ""},
 		{"QUICConfig.EnableSessionEvents", Field, 23, ""},
 		{"QUICConfig.TLSConfig", Field, 21, ""},
 		{"QUICConn", Type, 21, ""},
@@ -1334,6 +1376,7 @@
 		{"Certificate.PublicKeyAlgorithm", Field, 0, ""},
 		{"Certificate.Raw", Field, 0, ""},
 		{"Certificate.RawIssuer", Field, 0, ""},
+		{"Certificate.RawSignatureAlgorithm", Field, 27, ""},
 		{"Certificate.RawSubject", Field, 0, ""},
 		{"Certificate.RawSubjectPublicKeyInfo", Field, 0, ""},
 		{"Certificate.RawTBSCertificate", Field, 0, ""},
@@ -1362,6 +1405,7 @@
 		{"CertificateRequest.PublicKey", Field, 3, ""},
 		{"CertificateRequest.PublicKeyAlgorithm", Field, 3, ""},
 		{"CertificateRequest.Raw", Field, 3, ""},
+		{"CertificateRequest.RawSignatureAlgorithm", Field, 27, ""},
 		{"CertificateRequest.RawSubject", Field, 3, ""},
 		{"CertificateRequest.RawSubjectPublicKeyInfo", Field, 3, ""},
 		{"CertificateRequest.RawTBSCertificateRequest", Field, 3, ""},
@@ -1422,6 +1466,10 @@
 		{"KeyUsageKeyEncipherment", Const, 0, ""},
 		{"MD2WithRSA", Const, 0, ""},
 		{"MD5WithRSA", Const, 0, ""},
+		{"MLDSA", Const, 27, ""},
+		{"MLDSA44", Const, 27, ""},
+		{"MLDSA65", Const, 27, ""},
+		{"MLDSA87", Const, 27, ""},
 		{"MarshalECPrivateKey", Func, 2, "func(key *ecdsa.PrivateKey) ([]byte, error)"},
 		{"MarshalPKCS1PrivateKey", Func, 0, "func(key *rsa.PrivateKey) []byte"},
 		{"MarshalPKCS1PublicKey", Func, 10, "func(key *rsa.PublicKey) []byte"},
@@ -1468,6 +1516,7 @@
 		{"RevocationList.Number", Field, 15, ""},
 		{"RevocationList.Raw", Field, 19, ""},
 		{"RevocationList.RawIssuer", Field, 19, ""},
+		{"RevocationList.RawSignatureAlgorithm", Field, 27, ""},
 		{"RevocationList.RawTBSRevocationList", Field, 19, ""},
 		{"RevocationList.RevokedCertificateEntries", Field, 21, ""},
 		{"RevocationList.RevokedCertificates", Field, 15, ""},
@@ -1648,6 +1697,7 @@
 		{"(Scanner).Scan", Method, 0, ""},
 		{"ColumnType", Type, 8, ""},
 		{"Conn", Type, 9, ""},
+		{"ConvertAssign", Func, 27, "func(scanCtx driver.ScanContext, dest any, src driver.Value) error"},
 		{"DB", Type, 0, ""},
 		{"DBStats", Type, 5, ""},
 		{"DBStats.Idle", Field, 11, ""},
@@ -1744,6 +1794,11 @@
 		{"(Rows).Next", Method, 0, ""},
 		{"(RowsAffected).LastInsertId", Method, 0, ""},
 		{"(RowsAffected).RowsAffected", Method, 0, ""},
+		{"(RowsColumnScanner).Close", Method, 27, ""},
+		{"(RowsColumnScanner).Columns", Method, 27, ""},
+		{"(RowsColumnScanner).Next", Method, 27, ""},
+		{"(RowsColumnScanner).NextRow", Method, 27, ""},
+		{"(RowsColumnScanner).ScanColumn", Method, 27, ""},
 		{"(RowsColumnTypeDatabaseTypeName).Close", Method, 8, ""},
 		{"(RowsColumnTypeDatabaseTypeName).ColumnTypeDatabaseTypeName", Method, 8, ""},
 		{"(RowsColumnTypeDatabaseTypeName).Columns", Method, 8, ""},
@@ -1815,12 +1870,14 @@
 		{"ResultNoRows", Var, 0, ""},
 		{"Rows", Type, 0, ""},
 		{"RowsAffected", Type, 0, ""},
+		{"RowsColumnScanner", Type, 27, ""},
 		{"RowsColumnTypeDatabaseTypeName", Type, 8, ""},
 		{"RowsColumnTypeLength", Type, 8, ""},
 		{"RowsColumnTypeNullable", Type, 8, ""},
 		{"RowsColumnTypePrecisionScale", Type, 8, ""},
 		{"RowsColumnTypeScanType", Type, 8, ""},
 		{"RowsNextResultSet", Type, 8, ""},
+		{"ScanContext", Type, 27, ""},
 		{"SessionResetter", Type, 10, ""},
 		{"Stmt", Type, 0, ""},
 		{"StmtExecContext", Type, 8, ""},
@@ -5038,24 +5095,32 @@
 		{"(*InvalidUnmarshalError).Error", Method, 0, ""},
 		{"(*MarshalerError).Error", Method, 0, ""},
 		{"(*MarshalerError).Unwrap", Method, 13, ""},
+		{"(*Number).UnmarshalJSONFrom", Method, 27, ""},
 		{"(*RawMessage).MarshalJSON", Method, 0, ""},
 		{"(*RawMessage).UnmarshalJSON", Method, 0, ""},
 		{"(*SyntaxError).Error", Method, 0, ""},
 		{"(*UnmarshalFieldError).Error", Method, 0, ""},
 		{"(*UnmarshalTypeError).Error", Method, 0, ""},
+		{"(*UnmarshalTypeError).Unwrap", Method, 27, ""},
 		{"(*UnsupportedTypeError).Error", Method, 0, ""},
 		{"(*UnsupportedValueError).Error", Method, 0, ""},
 		{"(Delim).String", Method, 5, ""},
 		{"(Marshaler).MarshalJSON", Method, 0, ""},
 		{"(Number).Float64", Method, 1, ""},
 		{"(Number).Int64", Method, 1, ""},
+		{"(Number).MarshalJSONTo", Method, 27, ""},
 		{"(Number).String", Method, 1, ""},
 		{"(RawMessage).MarshalJSON", Method, 8, ""},
 		{"(Unmarshaler).UnmarshalJSON", Method, 0, ""},
+		{"CallMethodsWithLegacySemantics", Func, 27, "func(v bool) Options"},
 		{"Compact", Func, 0, "func(dst *bytes.Buffer, src []byte) error"},
 		{"Decoder", Type, 0, ""},
+		{"DefaultOptionsV1", Func, 27, "func() Options"},
 		{"Delim", Type, 5, ""},
 		{"Encoder", Type, 0, ""},
+		{"FormatByteArrayAsArray", Func, 27, "func(v bool) Options"},
+		{"FormatBytesWithLegacySemantics", Func, 27, "func(v bool) Options"},
+		{"FormatDurationAsNano", Func, 27, "func(v bool) Options"},
 		{"HTMLEscape", Func, 0, "func(dst *bytes.Buffer, src []byte)"},
 		{"Indent", Func, 0, "func(dst *bytes.Buffer, src []byte, prefix string, indent string) error"},
 		{"InvalidUTF8Error", Type, 0, ""},
@@ -5068,19 +5133,29 @@
 		{"MarshalerError", Type, 0, ""},
 		{"MarshalerError.Err", Field, 0, ""},
 		{"MarshalerError.Type", Field, 0, ""},
+		{"MatchCaseSensitiveDelimiter", Func, 27, "func(v bool) Options"},
+		{"MergeWithLegacySemantics", Func, 27, "func(v bool) Options"},
 		{"NewDecoder", Func, 0, "func(r io.Reader) *Decoder"},
 		{"NewEncoder", Func, 0, "func(w io.Writer) *Encoder"},
 		{"Number", Type, 1, ""},
+		{"OmitEmptyWithLegacySemantics", Func, 27, "func(v bool) Options"},
+		{"Options", Type, 27, ""},
+		{"ParseBytesWithLooseRFC4648", Func, 27, "func(v bool) Options"},
+		{"ParseTimeWithLooseRFC3339", Func, 27, "func(v bool) Options"},
 		{"RawMessage", Type, 0, ""},
+		{"ReportErrorsWithLegacySemantics", Func, 27, "func(v bool) Options"},
+		{"StringifyWithLegacySemantics", Func, 27, "func(v bool) Options"},
 		{"SyntaxError", Type, 0, ""},
 		{"SyntaxError.Offset", Field, 0, ""},
 		{"Token", Type, 5, ""},
 		{"Unmarshal", Func, 0, "func(data []byte, v any) error"},
+		{"UnmarshalArrayFromAnyLength", Func, 27, "func(v bool) Options"},
 		{"UnmarshalFieldError", Type, 0, ""},
 		{"UnmarshalFieldError.Field", Field, 0, ""},
 		{"UnmarshalFieldError.Key", Field, 0, ""},
 		{"UnmarshalFieldError.Type", Field, 0, ""},
 		{"UnmarshalTypeError", Type, 0, ""},
+		{"UnmarshalTypeError.Err", Field, 27, ""},
 		{"UnmarshalTypeError.Field", Field, 8, ""},
 		{"UnmarshalTypeError.Offset", Field, 5, ""},
 		{"UnmarshalTypeError.Struct", Field, 8, ""},
@@ -5094,6 +5169,158 @@
 		{"UnsupportedValueError.Value", Field, 0, ""},
 		{"Valid", Func, 9, "func(data []byte) bool"},
 	},
+	"encoding/json/jsontext": {
+		{"(*Decoder).InputOffset", Method, 27, ""},
+		{"(*Decoder).Options", Method, 27, ""},
+		{"(*Decoder).PeekKind", Method, 27, ""},
+		{"(*Decoder).ReadToken", Method, 27, ""},
+		{"(*Decoder).ReadValue", Method, 27, ""},
+		{"(*Decoder).Reset", Method, 27, ""},
+		{"(*Decoder).SkipValue", Method, 27, ""},
+		{"(*Decoder).StackDepth", Method, 27, ""},
+		{"(*Decoder).StackIndex", Method, 27, ""},
+		{"(*Decoder).StackPointer", Method, 27, ""},
+		{"(*Decoder).UnreadBuffer", Method, 27, ""},
+		{"(*Encoder).AvailableBuffer", Method, 27, ""},
+		{"(*Encoder).Options", Method, 27, ""},
+		{"(*Encoder).OutputOffset", Method, 27, ""},
+		{"(*Encoder).Reset", Method, 27, ""},
+		{"(*Encoder).StackDepth", Method, 27, ""},
+		{"(*Encoder).StackIndex", Method, 27, ""},
+		{"(*Encoder).StackPointer", Method, 27, ""},
+		{"(*Encoder).WriteToken", Method, 27, ""},
+		{"(*Encoder).WriteValue", Method, 27, ""},
+		{"(*SyntacticError).Error", Method, 27, ""},
+		{"(*SyntacticError).Unwrap", Method, 27, ""},
+		{"(*Value).Canonicalize", Method, 27, ""},
+		{"(*Value).Compact", Method, 27, ""},
+		{"(*Value).Format", Method, 27, ""},
+		{"(*Value).Indent", Method, 27, ""},
+		{"(*Value).UnmarshalJSON", Method, 27, ""},
+		{"(Kind).String", Method, 27, ""},
+		{"(Pointer).AppendToken", Method, 27, ""},
+		{"(Pointer).Contains", Method, 27, ""},
+		{"(Pointer).IsValid", Method, 27, ""},
+		{"(Pointer).LastToken", Method, 27, ""},
+		{"(Pointer).Parent", Method, 27, ""},
+		{"(Pointer).Tokens", Method, 27, ""},
+		{"(Token).Bool", Method, 27, ""},
+		{"(Token).Clone", Method, 27, ""},
+		{"(Token).Float", Method, 27, ""},
+		{"(Token).Float32", Method, 27, ""},
+		{"(Token).Int", Method, 27, ""},
+		{"(Token).Kind", Method, 27, ""},
+		{"(Token).String", Method, 27, ""},
+		{"(Token).Uint", Method, 27, ""},
+		{"(Value).Clone", Method, 27, ""},
+		{"(Value).IsValid", Method, 27, ""},
+		{"(Value).Kind", Method, 27, ""},
+		{"(Value).MarshalJSON", Method, 27, ""},
+		{"(Value).String", Method, 27, ""},
+		{"AllowDuplicateNames", Func, 27, "func(v bool) Options"},
+		{"AllowInvalidUTF8", Func, 27, "func(v bool) Options"},
+		{"AppendFloat", Func, 27, "func(dst []byte, src float64, bits int) []byte"},
+		{"AppendFormat", Func, 27, "func[Bytes ~[]byte | ~string](dst []byte, src Bytes, opts ...Options) ([]byte, error)"},
+		{"AppendQuote", Func, 27, "func[Bytes ~[]byte | ~string](dst []byte, src Bytes) ([]byte, error)"},
+		{"AppendUnquote", Func, 27, "func[Bytes ~[]byte | ~string](dst []byte, src Bytes) ([]byte, error)"},
+		{"BeginArray", Var, 27, ""},
+		{"BeginObject", Var, 27, ""},
+		{"Bool", Func, 27, "func(b bool) Token"},
+		{"CanonicalizeRawFloats", Func, 27, "func(v bool) Options"},
+		{"CanonicalizeRawInts", Func, 27, "func(v bool) Options"},
+		{"Decoder", Type, 27, ""},
+		{"Encoder", Type, 27, ""},
+		{"EndArray", Var, 27, ""},
+		{"EndObject", Var, 27, ""},
+		{"ErrDuplicateName", Var, 27, ""},
+		{"ErrNonStringName", Var, 27, ""},
+		{"EscapeForHTML", Func, 27, "func(v bool) Options"},
+		{"EscapeForJS", Func, 27, "func(v bool) Options"},
+		{"False", Var, 27, ""},
+		{"Float", Func, 27, "func(n float64) Token"},
+		{"Float32", Func, 27, "func(n float32) Token"},
+		{"Int", Func, 27, "func(n int64) Token"},
+		{"Internal", Var, 27, ""},
+		{"Kind", Type, 27, ""},
+		{"KindBeginArray", Const, 27, ""},
+		{"KindBeginObject", Const, 27, ""},
+		{"KindEndArray", Const, 27, ""},
+		{"KindEndObject", Const, 27, ""},
+		{"KindFalse", Const, 27, ""},
+		{"KindInvalid", Const, 27, ""},
+		{"KindNull", Const, 27, ""},
+		{"KindNumber", Const, 27, ""},
+		{"KindString", Const, 27, ""},
+		{"KindTrue", Const, 27, ""},
+		{"Multiline", Func, 27, "func(v bool) Options"},
+		{"NewDecoder", Func, 27, "func(r io.Reader, opts ...Options) *Decoder"},
+		{"NewEncoder", Func, 27, "func(w io.Writer, opts ...Options) *Encoder"},
+		{"Null", Var, 27, ""},
+		{"Options", Type, 27, ""},
+		{"Pointer", Type, 27, ""},
+		{"PreserveRawStrings", Func, 27, "func(v bool) Options"},
+		{"ReorderRawObjects", Func, 27, "func(v bool) Options"},
+		{"SpaceAfterColon", Func, 27, "func(v bool) Options"},
+		{"SpaceAfterComma", Func, 27, "func(v bool) Options"},
+		{"String", Func, 27, "func(s string) Token"},
+		{"SyntacticError", Type, 27, ""},
+		{"SyntacticError.ByteOffset", Field, 27, ""},
+		{"SyntacticError.Err", Field, 27, ""},
+		{"SyntacticError.JSONPointer", Field, 27, ""},
+		{"Token", Type, 27, ""},
+		{"True", Var, 27, ""},
+		{"Uint", Func, 27, "func(n uint64) Token"},
+		{"Value", Type, 27, ""},
+		{"WithIndent", Func, 27, "func(indent string) Options"},
+		{"WithIndentPrefix", Func, 27, "func(prefix string) Options"},
+	},
+	"encoding/json/v2": {
+		{"(*SemanticError).Error", Method, 27, ""},
+		{"(*SemanticError).Unwrap", Method, 27, ""},
+		{"(Marshaler).MarshalJSON", Method, 27, ""},
+		{"(MarshalerTo).MarshalJSONTo", Method, 27, ""},
+		{"(Unmarshaler).UnmarshalJSON", Method, 27, ""},
+		{"(UnmarshalerFrom).UnmarshalJSONFrom", Method, 27, ""},
+		{"DefaultOptionsV2", Func, 27, "func() Options"},
+		{"Deterministic", Func, 27, "func(v bool) Options"},
+		{"ErrUnknownName", Var, 27, ""},
+		{"FormatNilMapAsNull", Func, 27, "func(v bool) Options"},
+		{"FormatNilSliceAsNull", Func, 27, "func(v bool) Options"},
+		{"GetOption", Func, 27, "func[T any](opts Options, setter func(T) Options) (T, bool)"},
+		{"JoinMarshalers", Func, 27, "func(ms ...*Marshalers) *Marshalers"},
+		{"JoinOptions", Func, 27, "func(srcs ...Options) Options"},
+		{"JoinUnmarshalers", Func, 27, "func(us ...*Unmarshalers) *Unmarshalers"},
+		{"Marshal", Func, 27, "func(in any, opts ...Options) (out []byte, err error)"},
+		{"MarshalEncode", Func, 27, "func(out *jsontext.Encoder, in any, opts ...Options) (err error)"},
+		{"MarshalFunc", Func, 27, "func[T any](fn func(T) ([]byte, error)) *Marshalers"},
+		{"MarshalToFunc", Func, 27, "func[T any](fn func(*jsontext.Encoder, T) error) *Marshalers"},
+		{"MarshalWrite", Func, 27, "func(out io.Writer, in any, opts ...Options) (err error)"},
+		{"Marshaler", Type, 27, ""},
+		{"MarshalerTo", Type, 27, ""},
+		{"Marshalers", Type, 27, ""},
+		{"MatchCaseInsensitiveNames", Func, 27, "func(v bool) Options"},
+		{"OmitZeroStructFields", Func, 27, "func(v bool) Options"},
+		{"Options", Type, 27, ""},
+		{"RejectUnknownMembers", Func, 27, "func(v bool) Options"},
+		{"SemanticError", Type, 27, ""},
+		{"SemanticError.ByteOffset", Field, 27, ""},
+		{"SemanticError.Err", Field, 27, ""},
+		{"SemanticError.GoType", Field, 27, ""},
+		{"SemanticError.JSONKind", Field, 27, ""},
+		{"SemanticError.JSONPointer", Field, 27, ""},
+		{"SemanticError.JSONValue", Field, 27, ""},
+		{"StringifyNumbers", Func, 27, "func(v bool) Options"},
+		{"Unmarshal", Func, 27, "func(in []byte, out any, opts ...Options) (err error)"},
+		{"UnmarshalDecode", Func, 27, "func(in *jsontext.Decoder, out any, opts ...Options) (err error)"},
+		{"UnmarshalFromFunc", Func, 27, "func[T any](fn func(*jsontext.Decoder, T) error) *Unmarshalers"},
+		{"UnmarshalFunc", Func, 27, "func[T any](fn func([]byte, T) error) *Unmarshalers"},
+		{"UnmarshalRead", Func, 27, "func(in io.Reader, out any, opts ...Options) (err error)"},
+		{"Unmarshaler", Type, 27, ""},
+		{"UnmarshalerFrom", Type, 27, ""},
+		{"Unmarshalers", Type, 27, ""},
+		{"WithMarshalers", Func, 27, "func(v *Marshalers) Options"},
+		{"WithUnmarshalers", Func, 27, "func(v *Unmarshalers) Options"},
+	},
 	"encoding/pem": {
 		{"Block", Type, 0, ""},
 		{"Block.Bytes", Field, 0, ""},
@@ -6002,6 +6229,7 @@
 		{"Shift", Func, 5, "func(x Value, op token.Token, s uint) Value"},
 		{"Sign", Func, 5, "func(x Value) int"},
 		{"String", Const, 5, ""},
+		{"StringLen", Func, 27, "func(x Value) int64"},
 		{"StringVal", Func, 5, "func(x Value) string"},
 		{"ToComplex", Func, 6, "func(x Value) Value"},
 		{"ToFloat", Func, 6, "func(x Value) Value"},
@@ -6183,6 +6411,7 @@
 		{"(*ErrorList).Add", Method, 0, ""},
 		{"(*ErrorList).RemoveMultiples", Method, 0, ""},
 		{"(*ErrorList).Reset", Method, 0, ""},
+		{"(*Scanner).End", Method, 27, ""},
 		{"(*Scanner).Init", Method, 0, ""},
 		{"(*Scanner).Scan", Method, 0, ""},
 		{"(Error).Error", Method, 0, ""},
@@ -6222,6 +6451,7 @@
 		{"(*File).SetLines", Method, 0, ""},
 		{"(*File).SetLinesForContent", Method, 0, ""},
 		{"(*File).Size", Method, 0, ""},
+		{"(*File).String", Method, 27, ""},
 		{"(*FileSet).AddExistingFiles", Method, 25, ""},
 		{"(*FileSet).AddFile", Method, 0, ""},
 		{"(*FileSet).Base", Method, 0, ""},
@@ -6529,6 +6759,7 @@
 		{"(*Tuple).Variables", Method, 24, ""},
 		{"(*TypeList).At", Method, 18, ""},
 		{"(*TypeList).Len", Method, 18, ""},
+		{"(*TypeList).String", Method, 27, ""},
 		{"(*TypeList).Types", Method, 24, ""},
 		{"(*TypeName).Exported", Method, 5, ""},
 		{"(*TypeName).Id", Method, 5, ""},
@@ -6547,6 +6778,7 @@
 		{"(*TypeParam).Underlying", Method, 18, ""},
 		{"(*TypeParamList).At", Method, 18, ""},
 		{"(*TypeParamList).Len", Method, 18, ""},
+		{"(*TypeParamList).String", Method, 27, ""},
 		{"(*TypeParamList).TypeParams", Method, 24, ""},
 		{"(*Union).Len", Method, 18, ""},
 		{"(*Union).String", Method, 18, ""},
@@ -6571,9 +6803,14 @@
 		{"(Checker).PkgNameOf", Method, 22, ""},
 		{"(Checker).TypeOf", Method, 5, ""},
 		{"(Error).Error", Method, 5, ""},
+		{"(Hasher).Equal", Method, 27, ""},
+		{"(Hasher).Hash", Method, 27, ""},
+		{"(HasherIgnoreTags).Equal", Method, 27, ""},
+		{"(HasherIgnoreTags).Hash", Method, 27, ""},
 		{"(Importer).Import", Method, 5, ""},
 		{"(ImporterFrom).Import", Method, 6, ""},
 		{"(ImporterFrom).ImportFrom", Method, 6, ""},
+		{"(Instance).String", Method, 27, ""},
 		{"(Object).Exported", Method, 5, ""},
 		{"(Object).Id", Method, 5, ""},
 		{"(Object).Name", Method, 5, ""},
@@ -6643,6 +6880,8 @@
 		{"Float32", Const, 5, ""},
 		{"Float64", Const, 5, ""},
 		{"Func", Type, 5, ""},
+		{"Hasher", Type, 27, ""},
+		{"HasherIgnoreTags", Type, 27, ""},
 		{"Id", Func, 5, "func(pkg *Package, name string) string"},
 		{"Identical", Func, 5, "func(x Type, y Type) bool"},
 		{"IdenticalIgnoreTags", Func, 8, "func(x Type, y Type) bool"},
@@ -6877,9 +7116,13 @@
 		{"(*Hash).Write", Method, 14, ""},
 		{"(*Hash).WriteByte", Method, 14, ""},
 		{"(*Hash).WriteString", Method, 14, ""},
+		{"(ComparableHasher).Equal", Method, 27, ""},
+		{"(ComparableHasher).Hash", Method, 27, ""},
 		{"Bytes", Func, 19, "func(seed Seed, b []byte) uint64"},
 		{"Comparable", Func, 24, "func[T comparable](seed Seed, v T) uint64"},
+		{"ComparableHasher", Type, 27, ""},
 		{"Hash", Type, 14, ""},
+		{"Hasher", Type, 27, ""},
 		{"MakeSeed", Func, 14, "func() Seed"},
 		{"Seed", Type, 14, ""},
 		{"String", Func, 19, "func(seed Seed, s string) uint64"},
@@ -8035,6 +8278,7 @@
 		{"(*Int).CmpAbs", Method, 10, ""},
 		{"(*Int).Div", Method, 0, ""},
 		{"(*Int).DivMod", Method, 0, ""},
+		{"(*Int).Divide", Method, 27, ""},
 		{"(*Int).Exp", Method, 0, ""},
 		{"(*Int).FillBytes", Method, 15, ""},
 		{"(*Int).Float64", Method, 21, ""},
@@ -8119,9 +8363,11 @@
 		{"Accuracy", Type, 5, ""},
 		{"AwayFromZero", Const, 5, ""},
 		{"Below", Const, 5, ""},
+		{"Ceil", Const, 27, ""},
 		{"ErrNaN", Type, 5, ""},
 		{"Exact", Const, 5, ""},
 		{"Float", Type, 5, ""},
+		{"Floor", Const, 27, ""},
 		{"Int", Type, 0, ""},
 		{"Jacobi", Func, 5, "func(x *Int, y *Int) int"},
 		{"MaxBase", Const, 0, ""},
@@ -8133,12 +8379,14 @@
 		{"NewRat", Func, 0, "func(a int64, b int64) *Rat"},
 		{"ParseFloat", Func, 5, "func(s string, base int, prec uint, mode RoundingMode) (f *Float, b int, err error)"},
 		{"Rat", Type, 0, ""},
+		{"Round", Const, 27, ""},
 		{"RoundingMode", Type, 5, ""},
 		{"ToNearestAway", Const, 5, ""},
 		{"ToNearestEven", Const, 5, ""},
 		{"ToNegativeInf", Const, 5, ""},
 		{"ToPositiveInf", Const, 5, ""},
 		{"ToZero", Const, 5, ""},
+		{"Trunc", Const, 27, ""},
 		{"Word", Type, 0, ""},
 	},
 	"math/bits": {
@@ -8290,6 +8538,7 @@
 		{"(*Rand).Int64", Method, 22, ""},
 		{"(*Rand).Int64N", Method, 22, ""},
 		{"(*Rand).IntN", Method, 22, ""},
+		{"(*Rand).N", Method, 27, ""},
 		{"(*Rand).NormFloat64", Method, 22, ""},
 		{"(*Rand).Perm", Method, 22, ""},
 		{"(*Rand).Shuffle", Method, 22, ""},
@@ -8985,7 +9234,7 @@
 		{"NoBody", Var, 8, ""},
 		{"NotFound", Func, 0, "func(w ResponseWriter, r *Request)"},
 		{"NotFoundHandler", Func, 0, "func() Handler"},
-		{"ParseCookie", Func, 23, "func(line string) ([]*Cookie, error)"},
+		{"ParseCookie", Func, 23, "func(line string) (#rv1 []*Cookie, #rv2 error)"},
 		{"ParseHTTPVersion", Func, 0, "func(vers string) (major int, minor int, ok bool)"},
 		{"ParseSetCookie", Func, 23, "func(line string) (*Cookie, error)"},
 		{"ParseTime", Func, 1, "func(text string) (t time.Time, err error)"},
@@ -9061,6 +9310,7 @@
 		{"Server.BaseContext", Field, 13, ""},
 		{"Server.ConnContext", Field, 13, ""},
 		{"Server.ConnState", Field, 3, ""},
+		{"Server.DisableClientPriority", Field, 27, ""},
 		{"Server.DisableGeneralOptionsHandler", Field, 20, ""},
 		{"Server.ErrorLog", Field, 3, ""},
 		{"Server.HTTP2", Field, 24, ""},
@@ -9226,6 +9476,7 @@
 		{"NewRequestWithContext", Func, 23, "func(ctx context.Context, method string, target string, body io.Reader) *http.Request"},
 		{"NewServer", Func, 0, "func(handler http.Handler) *Server"},
 		{"NewTLSServer", Func, 0, "func(handler http.Handler) *Server"},
+		{"NewTestServer", Func, 27, "func(t testing.TB, handler http.Handler) *Server"},
 		{"NewUnstartedServer", Func, 0, "func(handler http.Handler) *Server"},
 		{"ResponseRecorder", Type, 0, ""},
 		{"ResponseRecorder.Body", Field, 0, ""},
@@ -9596,6 +9847,7 @@
 		{"(*Error).Timeout", Method, 6, ""},
 		{"(*Error).Unwrap", Method, 13, ""},
 		{"(*URL).AppendBinary", Method, 24, ""},
+		{"(*URL).Clone", Method, 27, ""},
 		{"(*URL).EscapedFragment", Method, 15, ""},
 		{"(*URL).EscapedPath", Method, 5, ""},
 		{"(*URL).Hostname", Method, 8, ""},
@@ -9616,6 +9868,7 @@
 		{"(EscapeError).Error", Method, 0, ""},
 		{"(InvalidHostError).Error", Method, 6, ""},
 		{"(Values).Add", Method, 0, ""},
+		{"(Values).Clone", Method, 27, ""},
 		{"(Values).Del", Method, 0, ""},
 		{"(Values).Encode", Method, 0, ""},
 		{"(Values).Get", Method, 0, ""},
@@ -10793,6 +11046,7 @@
 		{"ContainsRune", Func, 0, "func(s string, r rune) bool"},
 		{"Count", Func, 0, "func(s string, substr string) int"},
 		{"Cut", Func, 18, "func(s string, sep string) (before string, after string, found bool)"},
+		{"CutLast", Func, 27, "func(s string, sep string) (before string, after string, found bool)"},
 		{"CutPrefix", Func, 20, "func(s string, prefix string) (after string, found bool)"},
 		{"CutSuffix", Func, 20, "func(s string, suffix string) (before string, found bool)"},
 		{"EqualFold", Func, 0, "func(s string, t string) bool"},
@@ -17476,6 +17730,7 @@
 		{"TestHandler", Func, 21, "func(h slog.Handler, results func() []map[string]any) error"},
 	},
 	"testing/synctest": {
+		{"Sleep", Func, 27, "func(d time.Duration)"},
 		{"Test", Func, 25, "func(t *testing.T, f func(*testing.T))"},
 		{"Wait", Func, 25, "func()"},
 	},
@@ -17980,6 +18235,7 @@
 		{"Bassa_Vah", Var, 4, ""},
 		{"Batak", Var, 0, ""},
 		{"Bengali", Var, 0, ""},
+		{"Beria_Erfe", Var, 27, ""},
 		{"Bhaiksuki", Var, 7, ""},
 		{"Bidi_Control", Var, 0, ""},
 		{"Bopomofo", Var, 0, ""},
@@ -18029,6 +18285,7 @@
 		{"Extender", Var, 0, ""},
 		{"FoldCategory", Var, 0, ""},
 		{"FoldScript", Var, 0, ""},
+		{"Garay", Var, 27, ""},
 		{"Georgian", Var, 0, ""},
 		{"Glagolitic", Var, 0, ""},
 		{"Gothic", Var, 0, ""},
@@ -18038,6 +18295,7 @@
 		{"Gujarati", Var, 0, ""},
 		{"Gunjala_Gondi", Var, 13, ""},
 		{"Gurmukhi", Var, 0, ""},
+		{"Gurung_Khema", Var, 27, ""},
 		{"Han", Var, 0, ""},
 		{"Hangul", Var, 0, ""},
 		{"Hanifi_Rohingya", Var, 13, ""},
@@ -18049,6 +18307,9 @@
 		{"Hyphen", Var, 0, ""},
 		{"IDS_Binary_Operator", Var, 0, ""},
 		{"IDS_Trinary_Operator", Var, 0, ""},
+		{"IDS_Unary_Operator", Var, 27, ""},
+		{"ID_Compat_Math_Continue", Var, 27, ""},
+		{"ID_Compat_Math_Start", Var, 27, ""},
 		{"Ideographic", Var, 0, ""},
 		{"Imperial_Aramaic", Var, 0, ""},
 		{"In", Func, 2, "func(r rune, ranges ...*RangeTable) bool"},
@@ -18082,6 +18343,7 @@
 		{"Khmer", Var, 0, ""},
 		{"Khojki", Var, 4, ""},
 		{"Khudawadi", Var, 4, ""},
+		{"Kirat_Rai", Var, 27, ""},
 		{"L", Var, 0, ""},
 		{"LC", Var, 25, ""},
 		{"Lao", Var, 0, ""},
@@ -18125,6 +18387,7 @@
 		{"Miao", Var, 1, ""},
 		{"Mn", Var, 0, ""},
 		{"Modi", Var, 4, ""},
+		{"Modifier_Combining_Mark", Var, 27, ""},
 		{"Mongolian", Var, 0, ""},
 		{"Mro", Var, 4, ""},
 		{"Multani", Var, 5, ""},
@@ -18145,6 +18408,7 @@
 		{"Nyiakeng_Puachue_Hmong", Var, 14, ""},
 		{"Ogham", Var, 0, ""},
 		{"Ol_Chiki", Var, 0, ""},
+		{"Ol_Onal", Var, 27, ""},
 		{"Old_Hungarian", Var, 5, ""},
 		{"Old_Italic", Var, 0, ""},
 		{"Old_North_Arabian", Var, 4, ""},
@@ -18214,6 +18478,7 @@
 		{"Sharada", Var, 1, ""},
 		{"Shavian", Var, 0, ""},
 		{"Siddham", Var, 4, ""},
+		{"Sidetic", Var, 27, ""},
 		{"SignWriting", Var, 5, ""},
 		{"SimpleFold", Func, 0, "func(r rune) rune"},
 		{"Sinhala", Var, 0, ""},
@@ -18227,6 +18492,7 @@
 		{"Space", Var, 0, ""},
 		{"SpecialCase", Type, 0, ""},
 		{"Sundanese", Var, 0, ""},
+		{"Sunuwar", Var, 27, ""},
 		{"Syloti_Nagri", Var, 0, ""},
 		{"Symbol", Var, 0, ""},
 		{"Syriac", Var, 0, ""},
@@ -18235,6 +18501,7 @@
 		{"Tai_Le", Var, 0, ""},
 		{"Tai_Tham", Var, 0, ""},
 		{"Tai_Viet", Var, 0, ""},
+		{"Tai_Yo", Var, 27, ""},
 		{"Takri", Var, 1, ""},
 		{"Tamil", Var, 0, ""},
 		{"Tangsa", Var, 21, ""},
@@ -18252,7 +18519,10 @@
 		{"ToLower", Func, 0, "func(r rune) rune"},
 		{"ToTitle", Func, 0, "func(r rune) rune"},
 		{"ToUpper", Func, 0, "func(r rune) rune"},
+		{"Todhri", Var, 27, ""},
+		{"Tolong_Siki", Var, 27, ""},
 		{"Toto", Var, 21, ""},
+		{"Tulu_Tigalari", Var, 27, ""},
 		{"TurkishCase", Var, 0, ""},
 		{"Ugaritic", Var, 0, ""},
 		{"Unified_Ideograph", Var, 0, ""},
@@ -18320,6 +18590,21 @@
 		{"String", Func, 0, ""},
 		{"StringData", Func, 0, ""},
 	},
+	"uuid": {
+		{"(*UUID).UnmarshalText", Method, 27, ""},
+		{"(UUID).AppendText", Method, 27, ""},
+		{"(UUID).Compare", Method, 27, ""},
+		{"(UUID).MarshalText", Method, 27, ""},
+		{"(UUID).String", Method, 27, ""},
+		{"Max", Func, 27, "func() UUID"},
+		{"MustParse", Func, 27, "func(s string) UUID"},
+		{"New", Func, 27, "func() UUID"},
+		{"NewV4", Func, 27, "func() UUID"},
+		{"NewV7", Func, 27, "func() UUID"},
+		{"Nil", Func, 27, "func() UUID"},
+		{"Parse", Func, 27, "func(s string) (UUID, error)"},
+		{"UUID", Type, 27, ""},
+	},
 	"weak": {
 		{"(Pointer).Value", Method, 24, ""},
 		{"Make", Func, 24, "func[T any](ptr *T) Pointer[T]"},
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/tools/internal/typesinternal/element.go /work/src/external-provisioner/vendor/golang.org/x/tools/internal/typesinternal/element.go
--- a/vendor/golang.org/x/tools/internal/typesinternal/element.go	2026-09-05 00:02:32.214805055 +0000
+++ b/vendor/golang.org/x/tools/internal/typesinternal/element.go	2026-09-05 00:03:04.626980680 +0000
@@ -37,6 +37,10 @@
 		tmset := msets.MethodSet(T)
 		for method := range tmset.Methods() {
 			sig := method.Type().(*types.Signature)
+			if sig.TypeParams() != nil {
+				continue // skip type-parameterized methods
+			}
+
 			// It is tempting to call visit(sig, false)
 			// but, as noted in golang.org/cl/65450043,
 			// the Signature.Recv field is ignored by
@@ -123,10 +127,10 @@
 
 		case *types.TypeParam, *types.Union:
 			// forEachReachable must not be called on parameterized types.
-			panic(T)
+			panic(fmt.Sprintf("ForEachElement called on type containing %T", T))
 
 		default:
-			panic(T)
+			panic(fmt.Sprintf("ForEachElement called on unexpected type %T", T))
 		}
 	}
 	visit(T, false)
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/tools/internal/typesinternal/types.go /work/src/external-provisioner/vendor/golang.org/x/tools/internal/typesinternal/types.go
--- a/vendor/golang.org/x/tools/internal/typesinternal/types.go	2026-09-05 00:02:32.214805055 +0000
+++ b/vendor/golang.org/x/tools/internal/typesinternal/types.go	2026-09-05 00:03:04.626980680 +0000
@@ -22,6 +22,7 @@
 	"go/ast"
 	"go/token"
 	"go/types"
+	"iter"
 	"reflect"
 
 	"golang.org/x/tools/go/ast/inspector"
@@ -242,3 +243,30 @@
 	}
 	return "unknown symbol"
 }
+
+// ImplicitFieldSelections returns the sequence of implicit embedded fields
+// traversed by the given selection. It skips the final leaf field or method.
+// The boolean component indicates whether the traversal traversed a pointer.
+func ImplicitFieldSelections(seln types.Selection) iter.Seq2[*types.Var, bool] {
+	return func(yield func(*types.Var, bool) bool) {
+		var (
+			t       = seln.Recv()
+			indices = seln.Index()
+		)
+		for _, idx := range indices[:len(indices)-1] {
+			ptr, isPtr := t.Underlying().(*types.Pointer)
+			if isPtr {
+				t = ptr.Elem()
+			}
+			structType, ok := t.Underlying().(*types.Struct)
+			if !ok {
+				break
+			}
+			field := structType.Field(idx)
+			if !yield(field, isPtr) {
+				break
+			}
+			t = field.Type()
+		}
+	}
+}
diff -Nur /work/src-orig/external-provisioner/vendor/golang.org/x/tools/internal/typesinternal/zerovalue.go /work/src/external-provisioner/vendor/golang.org/x/tools/internal/typesinternal/zerovalue.go
--- a/vendor/golang.org/x/tools/internal/typesinternal/zerovalue.go	2026-09-05 00:02:32.214805055 +0000
+++ b/vendor/golang.org/x/tools/internal/typesinternal/zerovalue.go	2026-09-05 00:03:04.626980680 +0000
@@ -259,13 +259,13 @@
 	case *types.Signature:
 		var params []*ast.Field
 		for v := range t.Params().Variables() {
+			var names []*ast.Ident
+			if v.Name() != "" {
+				names = []*ast.Ident{ast.NewIdent(v.Name())}
+			}
 			params = append(params, &ast.Field{
-				Type: TypeExpr(v.Type(), qual),
-				Names: []*ast.Ident{
-					{
-						Name: v.Name(),
-					},
-				},
+				Type:  TypeExpr(v.Type(), qual),
+				Names: names,
 			})
 		}
 		if t.Variadic() {
@@ -328,10 +328,10 @@
 		return expr
 
 	case *types.Struct:
-		return ast.NewIdent(t.String())
+		return ast.NewIdent(types.TypeString(t, qual))
 
 	case *types.Interface:
-		return ast.NewIdent(t.String())
+		return ast.NewIdent(types.TypeString(t, qual))
 
 	case *types.Union:
 		if t.Len() == 0 {
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/balancer/balancer.go /work/src/external-provisioner/vendor/google.golang.org/grpc/balancer/balancer.go
--- a/vendor/google.golang.org/grpc/balancer/balancer.go	2026-09-05 00:02:32.218805074 +0000
+++ b/vendor/google.golang.org/grpc/balancer/balancer.go	2026-09-05 00:03:04.666980884 +0000
@@ -60,7 +60,7 @@
 	if !envconfig.CaseSensitiveBalancerRegistries {
 		name = strings.ToLower(name)
 		if name != b.Name() {
-			logger.Warningf("Balancer registered with name %q. grpc-go will be switching to case sensitive balancer registries soon. After 2 releases, we will enable the env var by default.", b.Name())
+			logger.Warningf("Balancer registered with name %q. grpc-go has switched to case sensitive balancer registries. GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES env variable will be removed in release v1.82.0", b.Name())
 		}
 	}
 	m[name] = b
@@ -85,7 +85,7 @@
 	if !envconfig.CaseSensitiveBalancerRegistries {
 		lowerName := strings.ToLower(name)
 		if lowerName != name {
-			logger.Warningf("Balancer retrieved for name %q. grpc-go will be switching to case sensitive balancer registries soon. After 2 releases, we will enable the env var by default.", name)
+			logger.Warningf("Balancer retrieved for name %q. grpc-go has switched to case sensitive balancer registries. GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES env variable will be removed in release v1.82.0", name)
 		}
 		name = lowerName
 	}
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/balancer/pickfirst/pickfirst.go /work/src/external-provisioner/vendor/google.golang.org/grpc/balancer/pickfirst/pickfirst.go
--- a/vendor/google.golang.org/grpc/balancer/pickfirst/pickfirst.go	2026-09-05 00:02:32.218805074 +0000
+++ b/vendor/google.golang.org/grpc/balancer/pickfirst/pickfirst.go	2026-09-05 00:03:04.666980884 +0000
@@ -35,9 +35,9 @@
 	"google.golang.org/grpc/balancer"
 	"google.golang.org/grpc/balancer/pickfirst/internal"
 	"google.golang.org/grpc/connectivity"
+	"google.golang.org/grpc/experimental/balancer/weight"
 	expstats "google.golang.org/grpc/experimental/stats"
 	"google.golang.org/grpc/grpclog"
-	"google.golang.org/grpc/internal/balancer/weight"
 	"google.golang.org/grpc/internal/envconfig"
 	internalgrpclog "google.golang.org/grpc/internal/grpclog"
 	"google.golang.org/grpc/internal/pretty"
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/clientconn.go /work/src/external-provisioner/vendor/google.golang.org/grpc/clientconn.go
--- a/vendor/google.golang.org/grpc/clientconn.go	2026-09-05 00:02:32.218805074 +0000
+++ b/vendor/google.golang.org/grpc/clientconn.go	2026-09-05 00:03:04.658980844 +0000
@@ -24,12 +24,10 @@
 	"fmt"
 	"math"
 	"net/url"
-	"os"
 	"slices"
 	"strings"
 	"sync"
 	"sync/atomic"
-	"syscall"
 	"time"
 
 	"google.golang.org/grpc/balancer"
@@ -1573,26 +1571,13 @@
 // to the provided transport.GoAwayInfo, as specified by gRFC A94:
 // https://github.com/grpc/proposal/blob/master/A94-grpc-subchannel-disconnections-metrics.md
 func disconnectErrorString(info transport.GoAwayInfo) string {
-	err := info.Err
-	var sysErr syscall.Errno
-	switch {
-	case info.Reason != transport.GoAwayInvalid:
+	if info.Reason != transport.GoAwayInvalid {
 		return fmt.Sprintf("GOAWAY %s", info.GoAwayCode.String())
-	case err == nil:
-		return "unknown"
-	case errors.Is(err, context.Canceled):
-		return "subchannel shutdown"
-	case errors.Is(err, syscall.ECONNRESET):
-		return "connection reset"
-	case errors.Is(err, syscall.ETIMEDOUT), errors.Is(err, context.DeadlineExceeded), errors.Is(err, os.ErrDeadlineExceeded):
-		return "connection timed out"
-	case errors.Is(err, syscall.ECONNABORTED):
-		return "connection aborted"
-	case errors.As(err, &sysErr):
-		return "socket error"
-	default:
+	}
+	if info.Err == nil {
 		return "unknown"
 	}
+	return disconnectErrorLabel(info.Err)
 }
 
 // startHealthCheck starts the health checking stream (RPC) to watch the health
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/clientconn_disconnect_reason_noplan9.go /work/src/external-provisioner/vendor/google.golang.org/grpc/clientconn_disconnect_reason_noplan9.go
--- a/vendor/google.golang.org/grpc/clientconn_disconnect_reason_noplan9.go	1970-01-01 00:00:00.000000000 +0000
+++ b/vendor/google.golang.org/grpc/clientconn_disconnect_reason_noplan9.go	2026-09-05 00:03:04.658980844 +0000
@@ -0,0 +1,48 @@
+//go:build !plan9
+
+/*
+ *
+ * Copyright 2026 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpc
+
+import (
+	"context"
+	"errors"
+	"os"
+	"syscall"
+)
+
+// disconnectErrorLabel returns the grpc.disconnect_error metric label for a
+// transport error, as specified by gRFC A94.
+func disconnectErrorLabel(err error) string {
+	var sysErr syscall.Errno
+	switch {
+	case errors.Is(err, context.Canceled):
+		return "subchannel shutdown"
+	case errors.Is(err, syscall.ECONNRESET):
+		return "connection reset"
+	case errors.Is(err, syscall.ETIMEDOUT), errors.Is(err, context.DeadlineExceeded), errors.Is(err, os.ErrDeadlineExceeded):
+		return "connection timed out"
+	case errors.Is(err, syscall.ECONNABORTED):
+		return "connection aborted"
+	case errors.As(err, &sysErr):
+		return "socket error"
+	default:
+		return "unknown"
+	}
+}
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/clientconn_disconnect_reason_plan9.go /work/src/external-provisioner/vendor/google.golang.org/grpc/clientconn_disconnect_reason_plan9.go
--- a/vendor/google.golang.org/grpc/clientconn_disconnect_reason_plan9.go	1970-01-01 00:00:00.000000000 +0000
+++ b/vendor/google.golang.org/grpc/clientconn_disconnect_reason_plan9.go	2026-09-05 00:03:04.662980865 +0000
@@ -0,0 +1,39 @@
+/*
+ *
+ * Copyright 2026 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpc
+
+import (
+	"context"
+	"errors"
+	"os"
+)
+
+// disconnectErrorLabel returns the grpc.disconnect_error metric label for a
+// transport error, as specified by gRFC A94. syscall.Errno does not exist on
+// plan9, so only the portable classifications are available.
+func disconnectErrorLabel(err error) string {
+	switch {
+	case errors.Is(err, context.Canceled):
+		return "subchannel shutdown"
+	case errors.Is(err, context.DeadlineExceeded), errors.Is(err, os.ErrDeadlineExceeded):
+		return "connection timed out"
+	default:
+		return "unknown"
+	}
+}
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/dialoptions.go /work/src/external-provisioner/vendor/google.golang.org/grpc/dialoptions.go
--- a/vendor/google.golang.org/grpc/dialoptions.go	2026-09-05 00:02:32.218805074 +0000
+++ b/vendor/google.golang.org/grpc/dialoptions.go	2026-09-05 00:03:04.662980865 +0000
@@ -173,10 +173,8 @@
 // If this option is set to true every connection will release the buffer after
 // flushing the data on the wire.
 //
-// # Experimental
-//
-// Notice: This API is EXPERIMENTAL and may be changed or removed in a
-// later release.
+// Deprecated: shared write buffer is enabled by default. WithSharedWriteBuffer
+// will be removed in a future release.
 func WithSharedWriteBuffer(val bool) DialOption {
 	return newFuncDialOption(func(o *dialOptions) {
 		o.copts.SharedWriteBuffer = val
@@ -229,6 +227,14 @@
 
 // WithStaticStreamWindowSize returns a DialOption which sets the initial
 // stream window size to the value provided and disables dynamic flow control.
+//
+// Note that this also disables dynamic flow control for the connection,
+// falling back to a default static connection-level window of 64KB. To
+// use a larger connection-level window, you must also use the
+// [WithStaticConnWindowSize] DialOption.
+//
+// Most users should not configure static flow control windows unless
+// operating in a memory-constrained environment.
 func WithStaticStreamWindowSize(s int32) DialOption {
 	return newFuncDialOption(func(o *dialOptions) {
 		o.copts.InitialWindowSize = s
@@ -239,6 +245,14 @@
 // WithStaticConnWindowSize returns a DialOption which sets the initial
 // connection window size to the value provided and disables dynamic flow
 // control.
+//
+// Note that this also disables dynamic flow control for individual streams,
+// falling back to a default static connection-level window of 64KB. To
+// explicitly configure the stream-level window size, you must also use the
+// [WithStaticStreamWindowSize] DialOption.
+//
+// Most users should not configure static flow control windows unless
+// operating in a memory-constrained environment.
 func WithStaticConnWindowSize(s int32) DialOption {
 	return newFuncDialOption(func(o *dialOptions) {
 		o.copts.InitialConnWindowSize = s
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/encoding/encoding.go /work/src/external-provisioner/vendor/google.golang.org/grpc/encoding/encoding.go
--- a/vendor/google.golang.org/grpc/encoding/encoding.go	2026-09-05 00:02:32.218805074 +0000
+++ b/vendor/google.golang.org/grpc/encoding/encoding.go	2026-09-05 00:03:04.670980905 +0000
@@ -66,6 +66,9 @@
 	// Decompress reads data from r, decompresses it, and provides the
 	// uncompressed data via the returned io.Reader.  If an error occurs while
 	// initializing the decompressor, that error is returned instead.
+	//
+	// The returned io.Reader may optionally implement io.ReadCloser, and if it
+	// does, gRPC will call Close() exactly once.
 	Decompress(r io.Reader) (io.Reader, error)
 	// Name is the name of the compression codec and is used to set the content
 	// coding header.  The result must be static; the result cannot change
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/encoding/gzip/gzip.go /work/src/external-provisioner/vendor/google.golang.org/grpc/encoding/gzip/gzip.go
--- a/vendor/google.golang.org/grpc/encoding/gzip/gzip.go	2026-09-05 00:02:32.218805074 +0000
+++ b/vendor/google.golang.org/grpc/encoding/gzip/gzip.go	2026-09-05 00:03:04.670980905 +0000
@@ -81,6 +81,8 @@
 	return z.Writer.Close()
 }
 
+var _ io.Closer = &reader{}
+
 type reader struct {
 	*gzip.Reader
 	pool *sync.Pool
@@ -102,14 +104,16 @@
 	return z, nil
 }
 
-func (z *reader) Read(p []byte) (n int, err error) {
-	n, err = z.Reader.Read(p)
-	if err == io.EOF {
-		z.pool.Put(z)
-	}
+func (r *reader) Read(p []byte) (n int, err error) {
+	n, err = r.Reader.Read(p)
 	return n, err
 }
 
+func (r *reader) Close() error {
+	defer r.pool.Put(r)
+	return r.Reader.Close()
+}
+
 func (c *compressor) Name() string {
 	return Name
 }
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/experimental/balancer/weight/weight.go /work/src/external-provisioner/vendor/google.golang.org/grpc/experimental/balancer/weight/weight.go
--- a/vendor/google.golang.org/grpc/experimental/balancer/weight/weight.go	1970-01-01 00:00:00.000000000 +0000
+++ b/vendor/google.golang.org/grpc/experimental/balancer/weight/weight.go	2026-09-05 00:03:04.670980905 +0000
@@ -0,0 +1,60 @@
+/*
+ *
+ * Copyright 2025 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package weight contains utilities to manage endpoint weights.
+// Weights may be used by LB policies to distribute load across
+// multiple endpoints.
+//
+// # Experimental
+//
+// Notice: All APIs in this package are EXPERIMENTAL and may be changed
+// or removed in a later release.
+package weight
+
+import "google.golang.org/grpc/resolver"
+
+// attributeKey is the type used as the key to store EndpointInfo in the
+// Attributes field of resolver.Endpoint.
+type attributeKey struct{}
+
+// EndpointInfo will be stored in the Attributes field of Endpoints.
+type EndpointInfo struct {
+	Weight uint32
+}
+
+// Equal allows the values to be compared by Attributes.Equal.
+func (a EndpointInfo) Equal(o any) bool {
+	oa, ok := o.(EndpointInfo)
+	return ok && oa.Weight == a.Weight
+}
+
+// Set returns a copy of endpoint in which the Attributes field is
+// updated with EndpointInfo.
+func Set(endpoint resolver.Endpoint, epInfo EndpointInfo) resolver.Endpoint {
+	endpoint.Attributes = endpoint.Attributes.WithValue(attributeKey{}, epInfo)
+	return endpoint
+}
+
+// FromEndpoint returns the EndpointInfo stored in the Attributes
+// field of an endpoint. It returns an empty EndpointInfo if attribute
+// is not found.
+func FromEndpoint(endpoint resolver.Endpoint) EndpointInfo {
+	v := endpoint.Attributes.Value(attributeKey{})
+	ei, _ := v.(EndpointInfo)
+	return ei
+}
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/health/grpc_health_v1/health_grpc.pb.go /work/src/external-provisioner/vendor/google.golang.org/grpc/health/grpc_health_v1/health_grpc.pb.go
--- a/vendor/google.golang.org/grpc/health/grpc_health_v1/health_grpc.pb.go	2026-09-05 00:02:32.222805094 +0000
+++ b/vendor/google.golang.org/grpc/health/grpc_health_v1/health_grpc.pb.go	2026-09-05 00:03:04.670980905 +0000
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.6.1
+// - protoc-gen-go-grpc v1.6.2
 // - protoc             v5.27.1
 // source: grpc/health/v1/health.proto
 
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/internal/balancer/weight/weight.go /work/src/external-provisioner/vendor/google.golang.org/grpc/internal/balancer/weight/weight.go
--- a/vendor/google.golang.org/grpc/internal/balancer/weight/weight.go	2026-09-05 00:02:32.222805094 +0000
+++ b/vendor/google.golang.org/grpc/internal/balancer/weight/weight.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,66 +0,0 @@
-/*
- *
- * Copyright 2025 gRPC authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- */
-
-// Package weight contains utilities to manage endpoint weights. Weights are
-// used by LB policies such as ringhash to distribute load across multiple
-// endpoints.
-package weight
-
-import (
-	"fmt"
-
-	"google.golang.org/grpc/resolver"
-)
-
-// attributeKey is the type used as the key to store EndpointInfo in the
-// Attributes field of resolver.Endpoint.
-type attributeKey struct{}
-
-// EndpointInfo will be stored in the Attributes field of Endpoints in order to
-// use the ringhash balancer.
-type EndpointInfo struct {
-	Weight uint32
-}
-
-// Equal allows the values to be compared by Attributes.Equal.
-func (a EndpointInfo) Equal(o any) bool {
-	oa, ok := o.(EndpointInfo)
-	return ok && oa.Weight == a.Weight
-}
-
-// Set returns a copy of endpoint in which the Attributes field is updated with
-// EndpointInfo.
-func Set(endpoint resolver.Endpoint, epInfo EndpointInfo) resolver.Endpoint {
-	endpoint.Attributes = endpoint.Attributes.WithValue(attributeKey{}, epInfo)
-	return endpoint
-}
-
-// String returns a human-readable representation of EndpointInfo.
-// This method is intended for logging, testing, and debugging purposes only.
-// Do not rely on the output format, as it is not guaranteed to remain stable.
-func (a EndpointInfo) String() string {
-	return fmt.Sprintf("Weight: %d", a.Weight)
-}
-
-// FromEndpoint returns the EndpointInfo stored in the Attributes field of an
-// endpoint. It returns an empty EndpointInfo if attribute is not found.
-func FromEndpoint(endpoint resolver.Endpoint) EndpointInfo {
-	v := endpoint.Attributes.Value(attributeKey{})
-	ei, _ := v.(EndpointInfo)
-	return ei
-}
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go /work/src/external-provisioner/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go
--- a/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go	2026-09-05 00:02:32.222805094 +0000
+++ b/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go	2026-09-05 00:03:04.674980925 +0000
@@ -59,6 +59,15 @@
 	// unconditionally.
 	XDSEndpointHashKeyBackwardCompat = boolFromEnv("GRPC_XDS_ENDPOINT_HASH_KEY_BACKWARD_COMPAT", false)
 
+	// LabelServerGoroutines controls setting [runtime/pprof.Labels] on the
+	// goroutines spawned by [grpc.Server] type.
+	// For now, this is limited to the goroutines spawned to handle incoming
+	// requests on the server.
+	// Set "GRPC_GO_SERVER_GOROUTINE_LABELS" to "grpc.method=true" to
+	// enable this grpc.method label, or "all" to enable all valid labels.
+	// This variable is a bit-field.
+	LabelServerGoroutines = goroutineLabelsFromEnv("GRPC_GO_SERVER_GOROUTINE_LABELS", 0)
+
 	// RingHashSetRequestHashKey is set if the ring hash balancer can get the
 	// request hash header by setting the "requestHashHeader" field, according
 	// to gRFC A76. It can be disabled by setting the environment variable
@@ -78,12 +87,12 @@
 	EnableDefaultPortForProxyTarget = boolFromEnv("GRPC_EXPERIMENTAL_ENABLE_DEFAULT_PORT_FOR_PROXY_TARGET", true)
 
 	// CaseSensitiveBalancerRegistries is set if the balancer registry should be
-	// case-sensitive. This is disabled by default, but can be enabled by setting
+	// case-sensitive. This is enabled by default, but can be disabled by setting
 	// the env variable "GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES"
-	// to "true".
+	// to "false".
 	//
-	// TODO: After 2 releases, we will enable the env var by default.
-	CaseSensitiveBalancerRegistries = boolFromEnv("GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES", false)
+	// This env varible will be removed in release v1.82.0.
+	CaseSensitiveBalancerRegistries = boolFromEnv("GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES", true)
 
 	// XDSAuthorityRewrite indicates whether xDS authority rewriting is enabled.
 	// This feature is defined in gRFC A81 and is enabled by setting the
@@ -104,22 +113,6 @@
 	// to "false".
 	XDSRecoverPanicInResourceParsing = boolFromEnv("GRPC_GO_EXPERIMENTAL_XDS_RESOURCE_PANIC_RECOVERY", true)
 
-	// DisableStrictPathChecking indicates whether strict path checking is
-	// disabled. This feature can be disabled by setting the environment
-	// variable GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING to "true".
-	//
-	// When strict path checking is enabled, gRPC will reject requests with
-	// paths that do not conform to the gRPC over HTTP/2 specification found at
-	// https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-HTTP2.md.
-	//
-	// When disabled, gRPC will allow paths that do not contain a leading slash.
-	// Enabling strict path checking is recommended for security reasons, as it
-	// prevents potential path traversal vulnerabilities.
-	//
-	// A future release will remove this environment variable, enabling strict
-	// path checking behavior unconditionally.
-	DisableStrictPathChecking = boolFromEnv("GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING", false)
-
 	// EnablePriorityLBChildPolicyCache controls whether the priority balancer
 	// should cache child balancers that are removed from the LB policy config,
 	// for a period of 15 minutes. This is disabled by default, but can be
@@ -127,6 +120,18 @@
 	// GRPC_EXPERIMENTAL_ENABLE_PRIORITY_LB_CHILD_POLICY_CACHE to true.
 	EnablePriorityLBChildPolicyCache = boolFromEnv("GRPC_EXPERIMENTAL_ENABLE_PRIORITY_LB_CHILD_POLICY_CACHE", false)
 
+	// Enable8KBDefaultHeaderListSize indicates that default maximum header list
+	// size is restricted to 8KB. This is disabled by default, but can be enabled
+	// by setting the environment variable
+	// "GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE" to "true".
+	// When disabled, the default maximum header list size of 16MB is used.
+	//
+	// When enabled, RPCs with a total size of headers exceeding 8KB will fail
+	// unless explicitly configured otherwise by the user.
+	//
+	// TODO: In release v1.82.0, env var will be enabled by default.
+	Enable8KBDefaultHeaderListSize = boolFromEnv("GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE", false)
+
 	// EnableHTTPFramerReadBufferPooling enables the use of the
 	// readyreader.Reader interface to perform non-memory-pinning reads,
 	// provided the underlying net.Conn supports it. This reduces memory usage
@@ -136,6 +141,27 @@
 	// feature if unforeseen issues arise, and it will be removed in a future
 	// release.
 	EnableHTTPFramerReadBufferPooling = boolFromEnv("GRPC_GO_EXPERIMENTAL_HTTP_FRAMER_READ_BUFFER_POOLING", true)
+
+	// ControlBufferThrottleLimit is the maximum number of control frames that can
+	// be queued in the control buffer before throttling is applied. The value
+	// must be between 1 and 10,000, and is set to 100 by default.
+	//
+	// This environment variable serves as an escape hatch to increase the
+	// throttling limit if unforeseen issues arise, and it will be removed in a
+	// future release.
+	//
+	// TODO: Remove this env var once v1.83.0 is released.
+	ControlBufferThrottleLimit = uint64FromEnv("GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT", 100, 1, 10000)
+
+	// EnableReceiveBufferCompaction enables the compaction of data buffers
+	// to reduce the number of buffers in the receive buffer.
+	//
+	// This environment variable serves as an escape hatch to disable the
+	// feature if unforeseen issues arise, and it will be removed in a future
+	// release.
+	//
+	// TODO: Remove this env var once v1.85.0 is released.
+	EnableReceiveBufferCompaction = boolFromEnv("GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION", true)
 )
 
 func boolFromEnv(envVar string, def bool) bool {
@@ -160,3 +186,52 @@
 	}
 	return v
 }
+
+// GoroutineLabels is a bitfield indicating which goroutine labels are enabled.
+type GoroutineLabels uint16
+
+func goroutineLabelsFromEnv(envVar string, def GoroutineLabels) GoroutineLabels {
+	val := def
+	v := os.Getenv(envVar)
+	if strings.EqualFold(v, "all") {
+		return AllGoroutineLabels
+	} else if strings.EqualFold(v, "none") {
+		return 0
+	}
+	for s := range strings.SplitSeq(v, ",") {
+		s = strings.TrimSpace(s)
+		if len(s) == 0 {
+			continue
+		}
+		pre, post, ok := strings.Cut(s, "=")
+		if !ok {
+			// no equals sign
+			continue
+		}
+		post = strings.TrimSpace(post)
+		pre = strings.TrimSpace(pre)
+		bitDesignator := GoroutineLabels(0)
+		switch {
+		case strings.EqualFold(pre, "grpc.method"):
+			bitDesignator = GoroutineLabelServerMethod
+		default:
+			continue
+		}
+		if strings.EqualFold(post, "true") {
+			val |= bitDesignator
+		} else if strings.EqualFold(post, "false") {
+			val &^= bitDesignator
+		}
+	}
+	return val
+}
+
+const (
+	// GoroutineLabelServerMethod sets the grpc.method label on new
+	// server-side gRPC streams.
+	GoroutineLabelServerMethod GoroutineLabels = 1 << iota
+)
+
+// AllGoroutineLabels is an or'd together bitfield of all valid GoroutineLabels
+// constant values (above).
+const AllGoroutineLabels = GoroutineLabelServerMethod
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/internal/envconfig/xds.go /work/src/external-provisioner/vendor/google.golang.org/grpc/internal/envconfig/xds.go
--- a/vendor/google.golang.org/grpc/internal/envconfig/xds.go	2026-09-05 00:02:32.222805094 +0000
+++ b/vendor/google.golang.org/grpc/internal/envconfig/xds.go	2026-09-05 00:03:04.674980925 +0000
@@ -69,9 +69,8 @@
 	// https://github.com/grpc/proposal/blob/master/A87-mtls-spiffe-support.md
 	XDSSPIFFEEnabled = boolFromEnv("GRPC_EXPERIMENTAL_XDS_MTLS_SPIFFE", false)
 
-	// XDSHTTPConnectEnabled is true if gRPC should parse custom Metadata
-	// configuring use of an HTTP CONNECT proxy via xDS from cluster resources.
-	// For more details, see:
+	// XDSHTTPConnectEnabled controls support for dynamic HTTP CONNECT proxying
+	// configured via the xDS control plane. For more details, see:
 	// https://github.com/grpc/proposal/blob/master/A86-xds-http-connect.md
 	XDSHTTPConnectEnabled = boolFromEnv("GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT", false)
 
@@ -88,5 +87,15 @@
 	// XDSORCAToLRSPropEnabled controls whether ORCA metrics are explicitly
 	// filtered and prefix-propagated to the LRS server. For more details, see:
 	// https://github.com/grpc/proposal/blob/master/A85-lrs-custom-metrics-changes.md
-	XDSORCAToLRSPropEnabled = boolFromEnv("GRPC_EXPERIMENTAL_XDS_ORCA_LRS_PROPAGATION", false)
+	XDSORCAToLRSPropEnabled = boolFromEnv("GRPC_EXPERIMENTAL_XDS_ORCA_LRS_PROPAGATION", true)
+
+	// XDSClientExtProcEnabled indicates whether ExtProc filter is enabled on
+	// the client side. For more details, see:
+	// https://github.com/grpc/proposal/blob/master/A93-xds-ext-proc.md
+	XDSClientExtProcEnabled = boolFromEnv("GRPC_EXPERIMENTAL_XDS_EXT_PROC_ON_CLIENT", false)
+
+	// GCPAuthenticationFilterEnabled enables the xDS GCP Authentication
+	// filter. For more details, see:
+	// https://github.com/grpc/proposal/blob/master/A83-xds-gcp-authn-filter.md
+	GCPAuthenticationFilterEnabled = boolFromEnv("GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER", false)
 )
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/internal/grpcsync/callback_serializer.go /work/src/external-provisioner/vendor/google.golang.org/grpc/internal/grpcsync/callback_serializer.go
--- a/vendor/google.golang.org/grpc/internal/grpcsync/callback_serializer.go	2026-09-05 00:02:32.222805094 +0000
+++ b/vendor/google.golang.org/grpc/internal/grpcsync/callback_serializer.go	2026-09-05 00:03:04.674980925 +0000
@@ -20,10 +20,15 @@
 
 import (
 	"context"
+	"errors"
 
 	"google.golang.org/grpc/internal/buffer"
 )
 
+// ErrSerializerClosed is returned by ScheduleAndWait if the CallbackSerializer
+// was closed before the callback could be scheduled.
+var ErrSerializerClosed = errors.New("callback serializer is closed")
+
 // CallbackSerializer provides a mechanism to schedule callbacks in a
 // synchronized manner. It provides a FIFO guarantee on the order of execution
 // of scheduled callbacks. New callbacks can be scheduled by invoking the
@@ -77,6 +82,27 @@
 	}
 }
 
+// ScheduleAndWait schedules the provided callback function f to be executed in
+// the order it was added and blocks until f has run. If the context passed to
+// NewCallbackSerializer was canceled before this method is called, f is not run
+// and ScheduleAndWait returns ErrSerializerClosed.
+//
+// Callbacks are expected to honor the context when performing any blocking
+// operations, and should return early when the context is canceled.
+func (cs *CallbackSerializer) ScheduleAndWait(f func(ctx context.Context)) error {
+	done := make(chan struct{})
+	var err error
+	cs.ScheduleOr(func(ctx context.Context) {
+		f(ctx)
+		close(done)
+	}, func() {
+		err = ErrSerializerClosed
+		close(done)
+	})
+	<-done
+	return err
+}
+
 func (cs *CallbackSerializer) run(ctx context.Context) {
 	defer close(cs.done)
 
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/internal/grpcutil/encode_duration.go /work/src/external-provisioner/vendor/google.golang.org/grpc/internal/grpcutil/encode_duration.go
--- a/vendor/google.golang.org/grpc/internal/grpcutil/encode_duration.go	2026-09-05 00:02:32.222805094 +0000
+++ b/vendor/google.golang.org/grpc/internal/grpcutil/encode_duration.go	2026-09-05 00:03:04.678980946 +0000
@@ -39,7 +39,6 @@
 //
 // https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-HTTP2.md#requests
 func EncodeDuration(t time.Duration) string {
-	// TODO: This is simplistic and not bandwidth efficient. Improve it.
 	if t <= 0 {
 		return "0n"
 	}
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/internal/grpcutil/regex.go /work/src/external-provisioner/vendor/google.golang.org/grpc/internal/grpcutil/regex.go
--- a/vendor/google.golang.org/grpc/internal/grpcutil/regex.go	2026-09-05 00:02:32.222805094 +0000
+++ b/vendor/google.golang.org/grpc/internal/grpcutil/regex.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,31 +0,0 @@
-/*
- *
- * Copyright 2021 gRPC authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- */
-
-package grpcutil
-
-import "regexp"
-
-// FullMatchWithRegex returns whether the full text matches the regex provided.
-func FullMatchWithRegex(re *regexp.Regexp, text string) bool {
-	if len(text) == 0 {
-		return re.MatchString(text)
-	}
-	re.Longest()
-	rem := re.FindString(text)
-	return len(rem) == len(text)
-}
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/internal/mem/buffer_pool.go /work/src/external-provisioner/vendor/google.golang.org/grpc/internal/mem/buffer_pool.go
--- a/vendor/google.golang.org/grpc/internal/mem/buffer_pool.go	2026-09-05 00:02:32.222805094 +0000
+++ b/vendor/google.golang.org/grpc/internal/mem/buffer_pool.go	2026-09-05 00:03:04.678980946 +0000
@@ -26,12 +26,26 @@
 	"slices"
 	"sort"
 	"sync"
+
+	"google.golang.org/grpc/internal"
 )
 
 const (
 	goPageSize = 4 * 1024 // 4KiB. N.B. this must be a power of 2.
 )
 
+var (
+	// BufferPoolingThreshold is the minimum size of a buffer that can be pooled.
+	// This is used to determine whether to pool buffers or allocate them directly.
+	BufferPoolingThreshold = 1 << 10
+)
+
+func init() {
+	internal.SetBufferPoolingThresholdForTesting = func(threshold int) {
+		BufferPoolingThreshold = threshold
+	}
+}
+
 var uintSize = bits.UintSize // use a variable for mocking during tests.
 
 // bufferPool is a copy of the public bufferPool interface used to avoid
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/internal/resolver/config_selector.go /work/src/external-provisioner/vendor/google.golang.org/grpc/internal/resolver/config_selector.go
--- a/vendor/google.golang.org/grpc/internal/resolver/config_selector.go	2026-09-05 00:02:32.222805094 +0000
+++ b/vendor/google.golang.org/grpc/internal/resolver/config_selector.go	2026-09-05 00:03:04.678980946 +0000
@@ -24,7 +24,6 @@
 	"sync"
 
 	"google.golang.org/grpc/internal/serviceconfig"
-	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/resolver"
 )
 
@@ -52,72 +51,7 @@
 	Context      context.Context
 	MethodConfig serviceconfig.MethodConfig // configuration to use for this RPC
 	OnCommitted  func()                     // Called when the RPC has been committed (retries no longer possible)
-	Interceptor  ClientInterceptor
-}
-
-// ClientStream is the same as grpc.ClientStream, but defined here for circular
-// dependency reasons.
-type ClientStream interface {
-	// Header returns the header metadata received from the server if there
-	// is any. It blocks if the metadata is not ready to read.
-	Header() (metadata.MD, error)
-	// Trailer returns the trailer metadata from the server, if there is any.
-	// It must only be called after stream.CloseAndRecv has returned, or
-	// stream.Recv has returned a non-nil error (including io.EOF).
-	Trailer() metadata.MD
-	// CloseSend closes the send direction of the stream. It closes the stream
-	// when non-nil error is met. It is also not safe to call CloseSend
-	// concurrently with SendMsg.
-	CloseSend() error
-	// Context returns the context for this stream.
-	//
-	// It should not be called until after Header or RecvMsg has returned. Once
-	// called, subsequent client-side retries are disabled.
-	Context() context.Context
-	// SendMsg is generally called by generated code. On error, SendMsg aborts
-	// the stream. If the error was generated by the client, the status is
-	// returned directly; otherwise, io.EOF is returned and the status of
-	// the stream may be discovered using RecvMsg.
-	//
-	// SendMsg blocks until:
-	//   - There is sufficient flow control to schedule m with the transport, or
-	//   - The stream is done, or
-	//   - The stream breaks.
-	//
-	// SendMsg does not wait until the message is received by the server. An
-	// untimely stream closure may result in lost messages. To ensure delivery,
-	// users should ensure the RPC completed successfully using RecvMsg.
-	//
-	// It is safe to have a goroutine calling SendMsg and another goroutine
-	// calling RecvMsg on the same stream at the same time, but it is not safe
-	// to call SendMsg on the same stream in different goroutines. It is also
-	// not safe to call CloseSend concurrently with SendMsg.
-	SendMsg(m any) error
-	// RecvMsg blocks until it receives a message into m or the stream is
-	// done. It returns io.EOF when the stream completes successfully. On
-	// any other error, the stream is aborted and the error contains the RPC
-	// status.
-	//
-	// It is safe to have a goroutine calling SendMsg and another goroutine
-	// calling RecvMsg on the same stream at the same time, but it is not
-	// safe to call RecvMsg on the same stream in different goroutines.
-	RecvMsg(m any) error
-}
-
-// ClientInterceptor is an interceptor for gRPC client streams.
-type ClientInterceptor interface {
-	// NewStream produces a ClientStream for an RPC which may optionally use
-	// the provided function to produce a stream for delegation.  Note:
-	// RPCInfo.Context should not be used (will be nil).
-	//
-	// done is invoked when the RPC is finished using its connection, or could
-	// not be assigned a connection.  RPC operations may still occur on
-	// ClientStream after done is called, since the interceptor is invoked by
-	// application-layer operations.  done must never be nil when called.
-	NewStream(ctx context.Context, ri RPCInfo, done func(), newStream func(ctx context.Context, done func()) (ClientStream, error)) (ClientStream, error)
-	// Close closes the interceptor. Once called, no new calls to NewStream are
-	// accepted. Ongoing calls to NewStream are allowed to complete.
-	Close()
+	Interceptor  any
 }
 
 // ServerInterceptor is an interceptor for incoming RPC's on gRPC server side.
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/internal/stats/labels.go /work/src/external-provisioner/vendor/google.golang.org/grpc/internal/stats/labels.go
--- a/vendor/google.golang.org/grpc/internal/stats/labels.go	2026-09-05 00:02:32.222805094 +0000
+++ b/vendor/google.golang.org/grpc/internal/stats/labels.go	2026-09-05 00:03:04.678980946 +0000
@@ -19,24 +19,56 @@
 // Package stats provides internal stats related functionality.
 package stats
 
-import "context"
+import (
+	"context"
+	"maps"
+)
 
-// Labels are the labels for metrics.
-type Labels struct {
-	// TelemetryLabels are the telemetry labels to record.
-	TelemetryLabels map[string]string
+// LabelCallback is a function that is executed when telemetry
+// label keys are updated.
+type LabelCallback func(map[string]string)
+type telemetryLabelCallbackKey struct{}
+
+// UpdateLabels executes registered telemetry callbacks with the update labels. Labels
+// are copied before being processed by any callbacks to ensure mutations are not
+// shared among derived contexts.
+//
+// It is the responsibility of the registrant to handle conflicts or label resets.
+func UpdateLabels(ctx context.Context, update map[string]string) {
+	executeTelemetryLabelCallbacks(ctx, update)
 }
 
-type labelsKey struct{}
+// RegisterTelemetryLabelCallback registers a callback function that is executed whenever
+// telemetry labels are updated.
+func RegisterTelemetryLabelCallback(ctx context.Context, callback LabelCallback) context.Context {
+	if callback == nil {
+		return ctx
+	}
+
+	callbacks, ok := ctx.Value(telemetryLabelCallbackKey{}).([]LabelCallback)
+	if !ok {
+		return context.WithValue(ctx, telemetryLabelCallbackKey{}, []LabelCallback{callback})
+	}
+	return context.WithValue(ctx, telemetryLabelCallbackKey{}, append(append([]LabelCallback(nil), callbacks...), callback))
 
-// GetLabels returns the Labels stored in the context, or nil if there is one.
-func GetLabels(ctx context.Context) *Labels {
-	labels, _ := ctx.Value(labelsKey{}).(*Labels)
-	return labels
 }
 
-// SetLabels sets the Labels in the context.
-func SetLabels(ctx context.Context, labels *Labels) context.Context {
-	// could also append
-	return context.WithValue(ctx, labelsKey{}, labels)
+// executeTelemetryLabelCallback runs the registered callbacks in the order they were
+// registered on the context with the provided labels. If no callbacks are registered
+// it does nothing.
+//
+// To ensure callbacks do not mutate the state of the provided label map it is copied
+// before execution.
+func executeTelemetryLabelCallbacks(ctx context.Context, labels map[string]string) {
+	callbacks, ok := ctx.Value(telemetryLabelCallbackKey{}).([]LabelCallback)
+	if !ok {
+		return
+	}
+
+	labelsCopy := map[string]string{}
+	maps.Copy(labelsCopy, labels)
+	for _, callback := range callbacks {
+		callback(labelsCopy)
+	}
+
 }
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/internal/transport/client_stream.go /work/src/external-provisioner/vendor/google.golang.org/grpc/internal/transport/client_stream.go
--- a/vendor/google.golang.org/grpc/internal/transport/client_stream.go	2026-09-05 00:02:32.222805094 +0000
+++ b/vendor/google.golang.org/grpc/internal/transport/client_stream.go	2026-09-05 00:03:04.682980966 +0000
@@ -19,6 +19,7 @@
 package transport
 
 import (
+	"fmt"
 	"sync/atomic"
 
 	"golang.org/x/net/http2"
@@ -28,13 +29,18 @@
 	"google.golang.org/grpc/status"
 )
 
+// nonGRPCDataMaxLen is the maximum length of nonGRPCDataBuf.
+//
+// NOTE: If changed this value, you MUST update the corresponding test in:
+//   - /test/end2end_test.go:TestHTTPServerSendsNonGRPCHeaderSurfaceFurtherData
+const nonGRPCDataMaxLen = 1024
+
 // ClientStream implements streaming functionality for a gRPC client.
 type ClientStream struct {
 	Stream // Embed for common stream functionality.
 
-	ct       *http2Client
-	done     chan struct{} // closed at the end of stream to unblock writers.
-	doneFunc func()        // invoked at the end of stream.
+	ct   *http2Client
+	done chan struct{} // closed at the end of stream to unblock writers.
 
 	headerChan chan struct{} // closed to indicate the end of header metadata.
 	header     metadata.MD   // the received header metadata
@@ -46,7 +52,11 @@
 	// headerValid indicates whether a valid header was received.  Only
 	// meaningful after headerChan is closed (always call waitOnHeader() before
 	// reading its value).
-	headerValid      bool
+	headerValid bool
+
+	nonGRPCStatus  *status.Status // the initial status from the non-gRPC response header, finalized with collected data before closing.
+	nonGRPCDataBuf []byte         // stores the data of a non-gRPC response.
+
 	noHeaders        bool          // set if the client never received headers (set only after the stream is done).
 	headerChanClosed uint32        // set when headerChan is closed. Used to avoid closing headerChan multiple times.
 	bytesReceived    atomic.Bool   // indicates whether any bytes have been received on this stream
@@ -54,6 +64,29 @@
 	statsHandler     stats.Handler // nil for internal streams (e.g., health check, ORCA) where telemetry is not supported.
 }
 
+func (s *ClientStream) startNonGRPCDataCollection(st *status.Status) {
+	s.nonGRPCStatus = st
+	s.nonGRPCDataBuf = make([]byte, 0, nonGRPCDataMaxLen)
+}
+
+// finalizeNonGRPCStatus builds the terminal status by appending the collected
+// response body to the original non-gRPC status message.
+func (s *ClientStream) finalizeNonGRPCStatus() *status.Status {
+	msg := fmt.Sprintf("%s\ndata: %q", s.nonGRPCStatus.Message(), s.nonGRPCDataBuf)
+	return status.New(s.nonGRPCStatus.Code(), msg)
+}
+
+// handleNonGRPCData collects non-gRPC body from the given data frame.
+// It returns non-nil value when the stream should be closed with it.
+func (s *ClientStream) handleNonGRPCData(f *parsedDataFrame) *status.Status {
+	n := min(f.data.Len(), nonGRPCDataMaxLen-len(s.nonGRPCDataBuf))
+	s.nonGRPCDataBuf = append(s.nonGRPCDataBuf, f.data.ReadOnlyData()[0:n]...)
+	if len(s.nonGRPCDataBuf) >= nonGRPCDataMaxLen || f.StreamEnded() {
+		return s.finalizeNonGRPCStatus()
+	}
+	return nil
+}
+
 // Read reads an n byte message from the input stream.
 func (s *ClientStream) Read(n int) (mem.BufferSlice, error) {
 	b, err := s.Stream.read(n)
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/internal/transport/controlbuf.go /work/src/external-provisioner/vendor/google.golang.org/grpc/internal/transport/controlbuf.go
--- a/vendor/google.golang.org/grpc/internal/transport/controlbuf.go	2026-09-05 00:02:32.222805094 +0000
+++ b/vendor/google.golang.org/grpc/internal/transport/controlbuf.go	2026-09-05 00:03:04.682980966 +0000
@@ -29,6 +29,7 @@
 
 	"golang.org/x/net/http2"
 	"golang.org/x/net/http2/hpack"
+	"google.golang.org/grpc/internal/envconfig"
 	"google.golang.org/grpc/internal/grpclog"
 	"google.golang.org/grpc/mem"
 )
@@ -96,61 +97,70 @@
 	return il.head == nil
 }
 
-// The following defines various control items which could flow through
-// the control buffer of transport. They represent different aspects of
-// control tasks, e.g., flow control, settings, streaming resetting, etc.
-
-// maxQueuedTransportResponseFrames is the most queued "transport response"
-// frames we will buffer before preventing new reads from occurring on the
-// transport.  These are control frames sent in response to client requests,
-// such as RST_STREAM due to bad headers or settings acks.
-const maxQueuedTransportResponseFrames = 50
+// maxQueuedControlBufferItems is the maximum number of frames (other than
+// HEADERS and DATA) that we will buffer before preventing new reads from
+// occurring on the transport.  These are control frames sent in response to
+// client requests, or frames that result in work being scheduled, such as
+// RST_STREAM due to bad headers or settings acks.
+var maxQueuedControlBufferItems = int(envconfig.ControlBufferThrottleLimit)
 
 type cbItem interface {
-	isTransportResponseFrame() bool
+	isThrottled() bool
 }
 
+// throttledItem represents every item in the controlBuffer to which the overall
+// throttling limit applies, other than outgoing HEADERS and DATA frames.
+type throttledItem struct{}
+
+func (throttledItem) isThrottled() bool { return true }
+
+// The following defines various control items which could flow through
+// the control buffer of transport. They represent different aspects of
+// control tasks, e.g., flow control, settings, streaming resetting, etc.
+
 // registerStream is used to register an incoming stream with loopy writer.
 type registerStream struct {
+	throttledItem
 	streamID uint32
 	wq       *writeQuota
 }
 
-func (*registerStream) isTransportResponseFrame() bool { return false }
-
-// headerFrame is also used to register stream on the client-side.
-type headerFrame struct {
+type clientHeaders struct {
 	streamID   uint32
 	hf         []hpack.HeaderField
-	endStream  bool               // Valid on server side.
-	initStream func(uint32) error // Used only on the client side.
+	initStream func(uint32) error
 	onWrite    func()
-	wq         *writeQuota    // write quota for the stream created.
-	cleanup    *cleanupStream // Valid on the server side.
-	onOrphaned func(error)    // Valid on client-side
+	wq         *writeQuota
+	onOrphaned func(error)
 }
 
-func (h *headerFrame) isTransportResponseFrame() bool {
-	return h.cleanup != nil && h.cleanup.rst // Results in a RST_STREAM
+func (*clientHeaders) isThrottled() bool { return false }
+
+type serverHeaders struct {
+	streamID  uint32
+	hf        []hpack.HeaderField
+	endStream bool
+	onWrite   func()
+	cleanup   *cleanupStream
 }
 
+func (h *serverHeaders) isThrottled() bool { return false }
+
 type cleanupStream struct {
+	throttledItem
 	streamID uint32
 	rst      bool
 	rstCode  http2.ErrCode
 	onWrite  func()
 }
 
-func (c *cleanupStream) isTransportResponseFrame() bool { return c.rst } // Results in a RST_STREAM
-
 type earlyAbortStream struct {
+	throttledItem
 	streamID uint32
 	rst      bool
 	hf       []hpack.HeaderField // Pre-built header fields
 }
 
-func (*earlyAbortStream) isTransportResponseFrame() bool { return false }
-
 type dataFrame struct {
 	streamID   uint32
 	endStream  bool
@@ -162,70 +172,60 @@
 	onEachWrite func()
 }
 
-func (*dataFrame) isTransportResponseFrame() bool { return false }
+func (*dataFrame) isThrottled() bool { return false }
 
 type incomingWindowUpdate struct {
+	throttledItem
 	streamID  uint32
 	increment uint32
 }
 
-func (*incomingWindowUpdate) isTransportResponseFrame() bool { return false }
-
 type outgoingWindowUpdate struct {
+	throttledItem
 	streamID  uint32
 	increment uint32
 }
 
-func (*outgoingWindowUpdate) isTransportResponseFrame() bool {
-	return false // window updates are throttled by thresholds
-}
-
 type incomingSettings struct {
+	throttledItem
 	ss []http2.Setting
 }
 
-func (*incomingSettings) isTransportResponseFrame() bool { return true } // Results in a settings ACK
-
 type outgoingSettings struct {
+	throttledItem
 	ss []http2.Setting
 }
 
-func (*outgoingSettings) isTransportResponseFrame() bool { return false }
-
 type incomingGoAway struct {
+	throttledItem
 }
 
-func (*incomingGoAway) isTransportResponseFrame() bool { return false }
-
 type goAway struct {
+	throttledItem
 	code      http2.ErrCode
 	debugData []byte
 	headsUp   bool
 	closeConn error // if set, loopyWriter will exit with this error
 }
 
-func (*goAway) isTransportResponseFrame() bool { return false }
-
 type ping struct {
+	throttledItem
 	ack  bool
 	data [8]byte
 }
 
-func (*ping) isTransportResponseFrame() bool { return true }
-
 type outFlowControlSizeRequest struct {
+	throttledItem
 	resp chan uint32
 }
 
-func (*outFlowControlSizeRequest) isTransportResponseFrame() bool { return false }
-
 // closeConnection is an instruction to tell the loopy writer to flush the
 // framer and exit, which will cause the transport's connection to be closed
 // (by the client or server).  The transport itself will close after the reader
 // encounters the EOF caused by the connection closure.
-type closeConnection struct{}
-
-func (closeConnection) isTransportResponseFrame() bool { return false }
+type closeConnection struct {
+	throttledItem
+}
 
 type outStreamState int
 
@@ -379,9 +379,9 @@
 		c.consumerWaiting = false
 	}
 	c.list.enqueue(it)
-	if it.isTransportResponseFrame() {
+	if it.isThrottled() {
 		c.transportResponseFrames++
-		if c.transportResponseFrames == maxQueuedTransportResponseFrames {
+		if c.transportResponseFrames == maxQueuedControlBufferItems {
 			// We are adding the frame that puts us over the threshold; create
 			// a throttling channel.
 			ch := make(chan struct{})
@@ -436,8 +436,8 @@
 		return nil, nil
 	}
 	h := c.list.dequeue().(cbItem)
-	if h.isTransportResponseFrame() {
-		if c.transportResponseFrames == maxQueuedTransportResponseFrames {
+	if h.isThrottled() {
+		if c.transportResponseFrames == maxQueuedControlBufferItems {
 			// We are removing the frame that put us over the
 			// threshold; close and clear the throttling channel.
 			ch := c.trfChan.Swap(nil)
@@ -464,10 +464,8 @@
 	// is still not aware of these yet.
 	for head := c.list.dequeueAll(); head != nil; head = head.next {
 		switch v := head.it.(type) {
-		case *headerFrame:
-			if v.onOrphaned != nil { // It will be nil on the server-side.
-				v.onOrphaned(ErrConnClosing)
-			}
+		case *clientHeaders:
+			v.onOrphaned(ErrConnClosing)
 		case *dataFrame:
 			if !v.processing {
 				v.data.Free()
@@ -680,42 +678,38 @@
 	l.estdStreams[h.streamID] = str
 }
 
-func (l *loopyWriter) headerHandler(h *headerFrame) error {
-	if l.side == serverSide {
-		str, ok := l.estdStreams[h.streamID]
-		if !ok {
-			if l.logger.V(logLevel) {
-				l.logger.Infof("Unrecognized streamID %d in loopyWriter", h.streamID)
-			}
-			return nil
-		}
-		// Case 1.A: Server is responding back with headers.
-		if !h.endStream {
-			return l.writeHeader(h.streamID, h.endStream, h.hf, h.onWrite)
+func (l *loopyWriter) serverHeaderHandler(hdr *serverHeaders) error {
+	str, ok := l.estdStreams[hdr.streamID]
+	if !ok {
+		if l.logger.V(logLevel) {
+			l.logger.Infof("Unrecognized streamID %d in loopyWriter", hdr.streamID)
 		}
-		// else:  Case 1.B: Server wants to close stream.
+		return nil
+	}
 
-		if str.state != empty { // either active or waiting on stream quota.
-			// add it str's list of items.
-			str.itl.enqueue(h)
-			return nil
-		}
-		if err := l.writeHeader(h.streamID, h.endStream, h.hf, h.onWrite); err != nil {
-			return err
-		}
-		return l.cleanupStreamHandler(h.cleanup)
+	// Case 1: Server is responding back with headers.
+	if !hdr.endStream {
+		return l.writeHeader(hdr.streamID, hdr.endStream, hdr.hf, hdr.onWrite)
+	}
+
+	// Case 2: Server is closing the stream.
+	if str.state != empty { // either active or waiting on stream quota.
+		str.itl.enqueue(hdr)
+		return nil
+	}
+	if err := l.writeHeader(hdr.streamID, hdr.endStream, hdr.hf, hdr.onWrite); err != nil {
+		return err
 	}
-	// Case 2: Client wants to originate stream.
+	return l.cleanupStreamHandler(hdr.cleanup)
+}
+
+func (l *loopyWriter) clientHeaderHandler(hdr *clientHeaders) error {
 	str := &outStream{
-		id:    h.streamID,
+		id:    hdr.streamID,
 		state: empty,
 		itl:   &itemList{},
-		wq:    h.wq,
+		wq:    hdr.wq,
 	}
-	return l.originateStream(str, h)
-}
-
-func (l *loopyWriter) originateStream(str *outStream, hdr *headerFrame) error {
 	// l.draining is set when handling GoAway. In which case, we want to avoid
 	// creating new streams.
 	if l.draining {
@@ -726,7 +720,7 @@
 	if err := hdr.initStream(str.id); err != nil {
 		return err
 	}
-	if err := l.writeHeader(str.id, hdr.endStream, hdr.hf, hdr.onWrite); err != nil {
+	if err := l.writeHeader(str.id, false, hdr.hf, hdr.onWrite); err != nil {
 		return err
 	}
 	l.estdStreams[str.id] = str
@@ -882,8 +876,10 @@
 		return l.incomingSettingsHandler(i)
 	case *outgoingSettings:
 		return l.outgoingSettingsHandler(i)
-	case *headerFrame:
-		return l.headerHandler(i)
+	case *clientHeaders:
+		return l.clientHeaderHandler(i)
+	case *serverHeaders:
+		return l.serverHeaderHandler(i)
 	case *registerStream:
 		l.registerStreamHandler(i)
 	case *cleanupStream:
@@ -956,39 +952,16 @@
 	// from data is copied to h to make as big as the maximum possible HTTP2 frame
 	// size.
 
-	if len(dataItem.h) == 0 && reader.Remaining() == 0 { // Empty data frame
-		// Client sends out empty data frame with endStream = true
-		if err := l.framer.writeData(dataItem.streamID, dataItem.endStream, nil); err != nil {
-			return false, err
-		}
-		str.itl.dequeue() // remove the empty data item from stream
-		reader.Close()
-		if str.itl.isEmpty() {
-			str.state = empty
-		} else if trailer, ok := str.itl.peek().(*headerFrame); ok { // the next item is trailers.
-			if err := l.writeHeader(trailer.streamID, trailer.endStream, trailer.hf, trailer.onWrite); err != nil {
-				return false, err
-			}
-			if err := l.cleanupStreamHandler(trailer.cleanup); err != nil {
-				return false, err
-			}
-		} else {
-			l.activeStreams.enqueue(str)
-		}
-		return false, nil
-	}
-
+	isEmpty := len(dataItem.h) == 0 && reader.Remaining() == 0
 	// Figure out the maximum size we can send
 	maxSize := http2MaxFrameLen
-	if strQuota := int(l.oiws) - str.bytesOutStanding; strQuota <= 0 { // stream-level flow control.
+	strQuota := int(l.oiws) - str.bytesOutStanding
+	if strQuota <= 0 && !isEmpty { // stream-level flow control.
 		str.state = waitingOnStreamQuota
 		return false, nil
-	} else if maxSize > strQuota {
-		maxSize = strQuota
-	}
-	if maxSize > int(l.sendQuota) { // connection-level flow control.
-		maxSize = int(l.sendQuota)
 	}
+	maxSize = min(maxSize, max(strQuota, 0))
+	maxSize = min(maxSize, int(l.sendQuota)) // connection-level flow control.
 	// Compute how much of the header and data we can send within quota and max frame length
 	hSize := min(maxSize, len(dataItem.h))
 	dSize := min(maxSize-hSize, reader.Remaining())
@@ -1039,19 +1012,23 @@
 		reader.Close()
 		str.itl.dequeue()
 	}
+	return false, l.updateStreamAfterWrite(str)
+}
+
+func (l *loopyWriter) updateStreamAfterWrite(str *outStream) error {
 	if str.itl.isEmpty() {
 		str.state = empty
-	} else if trailer, ok := str.itl.peek().(*headerFrame); ok { // The next item is trailers.
+	} else if trailer, ok := str.itl.peek().(*serverHeaders); ok { // the next item is trailers.
 		if err := l.writeHeader(trailer.streamID, trailer.endStream, trailer.hf, trailer.onWrite); err != nil {
-			return false, err
+			return err
 		}
 		if err := l.cleanupStreamHandler(trailer.cleanup); err != nil {
-			return false, err
+			return err
 		}
 	} else if int(l.oiws)-str.bytesOutStanding <= 0 { // Ran out of stream quota.
 		str.state = waitingOnStreamQuota
 	} else { // Otherwise add it back to the list of active streams.
 		l.activeStreams.enqueue(str)
 	}
-	return false, nil
+	return nil
 }
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/internal/transport/flowcontrol.go /work/src/external-provisioner/vendor/google.golang.org/grpc/internal/transport/flowcontrol.go
--- a/vendor/google.golang.org/grpc/internal/transport/flowcontrol.go	2026-09-05 00:02:32.222805094 +0000
+++ b/vendor/google.golang.org/grpc/internal/transport/flowcontrol.go	2026-09-05 00:03:04.682980966 +0000
@@ -115,7 +115,6 @@
 	return atomic.LoadUint32(&f.effectiveWindowSize)
 }
 
-// TODO(mmukhi): Simplify this code.
 // inFlow deals with inbound flow control
 type inFlow struct {
 	mu sync.Mutex
@@ -174,14 +173,14 @@
 // onData is invoked when some data frame is received. It updates pendingData.
 func (f *inFlow) onData(n uint32) error {
 	f.mu.Lock()
+	defer f.mu.Unlock()
+
 	f.pendingData += n
 	if f.pendingData+f.pendingUpdate > f.limit+f.delta {
 		limit := f.limit
 		rcvd := f.pendingData + f.pendingUpdate
-		f.mu.Unlock()
 		return fmt.Errorf("received %d-bytes data exceeding the limit %d bytes", rcvd, limit)
 	}
-	f.mu.Unlock()
 	return nil
 }
 
@@ -189,8 +188,9 @@
 // to be sent to the peer.
 func (f *inFlow) onRead(n uint32) uint32 {
 	f.mu.Lock()
+	defer f.mu.Unlock()
+
 	if f.pendingData == 0 {
-		f.mu.Unlock()
 		return 0
 	}
 	f.pendingData -= n
@@ -205,9 +205,7 @@
 	if f.pendingUpdate >= f.limit/4 {
 		wu := f.pendingUpdate
 		f.pendingUpdate = 0
-		f.mu.Unlock()
 		return wu
 	}
-	f.mu.Unlock()
 	return 0
 }
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/internal/transport/handler_server.go /work/src/external-provisioner/vendor/google.golang.org/grpc/internal/transport/handler_server.go
--- a/vendor/google.golang.org/grpc/internal/transport/handler_server.go	2026-09-05 00:02:32.222805094 +0000
+++ b/vendor/google.golang.org/grpc/internal/transport/handler_server.go	2026-09-05 00:03:04.682980966 +0000
@@ -424,7 +424,7 @@
 		st:               ht,
 		headerWireLength: 0, // won't have access to header wire length until golang/go#18997.
 	}
-	s.Stream.buf.init()
+	s.Stream.buf.init(ht.bufferPool)
 	s.readRequester = s
 	s.trReader = transportReader{
 		reader:        recvBufferReader{ctx: s.ctx, ctxDone: s.ctx.Done(), recv: &s.buf},
@@ -479,8 +479,8 @@
 
 func (ht *serverHandlerTransport) incrMsgRecv() {}
 
-func (ht *serverHandlerTransport) Drain(string) {
-	panic("Drain() is not implemented")
+func (ht *serverHandlerTransport) Drain(s string) {
+	ht.Close(errors.New(s))
 }
 
 // mapRecvMsgError returns the non-nil err into the appropriate
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/internal/transport/http2_client.go /work/src/external-provisioner/vendor/google.golang.org/grpc/internal/transport/http2_client.go
--- a/vendor/google.golang.org/grpc/internal/transport/http2_client.go	2026-09-05 00:02:32.226805114 +0000
+++ b/vendor/google.golang.org/grpc/internal/transport/http2_client.go	2026-09-05 00:03:04.682980966 +0000
@@ -39,6 +39,7 @@
 	"google.golang.org/grpc/internal"
 	"google.golang.org/grpc/internal/channelz"
 	icredentials "google.golang.org/grpc/internal/credentials"
+	"google.golang.org/grpc/internal/envconfig"
 	"google.golang.org/grpc/internal/grpclog"
 	"google.golang.org/grpc/internal/grpcsync"
 	"google.golang.org/grpc/internal/grpcutil"
@@ -318,7 +319,13 @@
 	}
 	writeBufSize := opts.WriteBufferSize
 	readBufSize := opts.ReadBufferSize
+	// The default header list size is moving from 16MB to 8KB. The 8KB limit
+	// is only used if Enable8KBDefaultHeaderListSize is true; otherwise, the
+	// old 16MB default is used. User-specified options always take precedence.
 	maxHeaderListSize := defaultClientMaxHeaderListSize
+	if envconfig.Enable8KBDefaultHeaderListSize {
+		maxHeaderListSize = upcomingDefaultHeaderListSize
+	}
 	if opts.MaxHeaderListSize != nil {
 		maxHeaderListSize = *opts.MaxHeaderListSize
 	}
@@ -491,10 +498,9 @@
 		ct:           t,
 		done:         make(chan struct{}),
 		headerChan:   make(chan struct{}),
-		doneFunc:     callHdr.DoneFunc,
 		statsHandler: handler,
 	}
-	s.Stream.buf.init()
+	s.Stream.buf.init(t.bufferPool)
 	s.Stream.wq.init(defaultWriteQuota, s.done)
 	s.readRequester = s
 	// The client side stream context should have exactly the same life cycle with the user provided context.
@@ -799,9 +805,8 @@
 			close(s.headerChan)
 		}
 	}
-	hdr := &headerFrame{
-		hf:        headerFields,
-		endStream: false,
+	hdr := &clientHeaders{
+		hf: headerFields,
 		initStream: func(uint32) error {
 			t.mu.Lock()
 			// TODO: handle transport closure in loopy instead and remove this
@@ -879,8 +884,8 @@
 				return false
 			}
 		}
-		if sz > int64(upcomingDefaultHeaderListSize) {
-			t.logger.Warningf("Header list size to send (%d bytes) is larger than the upcoming default limit (%d bytes). In a future release, this will be restricted to %d bytes.", sz, upcomingDefaultHeaderListSize, upcomingDefaultHeaderListSize)
+		if !envconfig.Enable8KBDefaultHeaderListSize && sz > int64(upcomingDefaultHeaderListSize) {
+			t.logger.Warningf("Header list size to send (%d bytes) is larger than the upcoming default limit (%d bytes). In release v1.82.0, GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE will be enabled by default, enforcing this limit.", sz, upcomingDefaultHeaderListSize)
 		}
 		return true
 	}
@@ -992,9 +997,6 @@
 	t.controlBuf.executeAndPut(addBackStreamQuota, cleanup)
 	// This will unblock write.
 	close(s.done)
-	if s.doneFunc != nil {
-		s.doneFunc()
-	}
 }
 
 // Close kicks off the shutdown process of the transport. This should be called
@@ -1224,10 +1226,30 @@
 			t.closeStream(s, io.EOF, true, http2.ErrCodeFlowControl, status.New(codes.Internal, err.Error()), nil, false)
 			return
 		}
+
+		if s.nonGRPCStatus != nil {
+			// The frame should be handled as a non-gRPC response body
+			st := s.handleNonGRPCData(f)
+			if st != nil {
+				t.closeStream(s, st.Err(), true, http2.ErrCodeProtocol, st, nil, true)
+				return
+			}
+			if w := s.fc.onRead(size); w > 0 {
+				t.controlBuf.put(&outgoingWindowUpdate{
+					streamID:  s.id,
+					increment: w,
+				})
+			}
+			return
+		}
+
 		dataLen := f.data.Len()
 		if f.Header().Flags.Has(http2.FlagDataPadded) {
 			if w := s.fc.onRead(size - uint32(dataLen)); w > 0 {
-				t.controlBuf.put(&outgoingWindowUpdate{s.id, w})
+				t.controlBuf.put(&outgoingWindowUpdate{
+					streamID:  s.id,
+					increment: w,
+				})
 			}
 		}
 		if dataLen > 0 {
@@ -1468,6 +1490,17 @@
 		return
 	}
 
+	// If we are collecting non-gRPC response data and receive a trailing
+	// HEADERS frame with END_STREAM, finalize the buffered data and close
+	// the stream.
+	if s.nonGRPCStatus != nil {
+		if endStream {
+			st := s.finalizeNonGRPCStatus()
+			t.closeStream(s, st.Err(), true, http2.ErrCodeProtocol, st, nil, true)
+		}
+		return
+	}
+
 	var (
 		// If a gRPC Response-Headers has already been received, then it means
 		// that the peer is speaking gRPC and we are in gRPC mode.
@@ -1568,7 +1601,12 @@
 		}
 
 		se := status.New(grpcErrorCode, strings.Join(errs, "; "))
-		t.closeStream(s, se.Err(), true, http2.ErrCodeProtocol, se, nil, endStream)
+		if endStream {
+			t.closeStream(s, se.Err(), true, http2.ErrCodeProtocol, se, nil, true)
+			return
+		}
+
+		s.startNonGRPCDataCollection(se)
 		return
 	}
 
@@ -1839,7 +1877,7 @@
 	resp := make(chan uint32, 1)
 	timer := time.NewTimer(time.Second)
 	defer timer.Stop()
-	t.controlBuf.put(&outFlowControlSizeRequest{resp})
+	t.controlBuf.put(&outFlowControlSizeRequest{resp: resp})
 	select {
 	case sz := <-resp:
 		return int64(sz)
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/internal/transport/http2_server.go /work/src/external-provisioner/vendor/google.golang.org/grpc/internal/transport/http2_server.go
--- a/vendor/google.golang.org/grpc/internal/transport/http2_server.go	2026-09-05 00:02:32.226805114 +0000
+++ b/vendor/google.golang.org/grpc/internal/transport/http2_server.go	2026-09-05 00:03:04.682980966 +0000
@@ -38,11 +38,13 @@
 	"google.golang.org/protobuf/proto"
 
 	"google.golang.org/grpc/internal"
+	"google.golang.org/grpc/internal/envconfig"
 	"google.golang.org/grpc/internal/grpclog"
 	"google.golang.org/grpc/internal/grpcutil"
 	"google.golang.org/grpc/internal/pretty"
 	istatus "google.golang.org/grpc/internal/status"
 	"google.golang.org/grpc/internal/syscall"
+	transportinternal "google.golang.org/grpc/internal/transport/internal"
 	"google.golang.org/grpc/mem"
 
 	"google.golang.org/grpc/codes"
@@ -165,7 +167,13 @@
 	}
 	writeBufSize := config.WriteBufferSize
 	readBufSize := config.ReadBufferSize
+	// The default header list size is moving from 16MB to 8KB. The 8KB limit
+	// is only used if Enable8KBDefaultHeaderListSize is true; otherwise, the
+	// old 16MB default is used. User-specified options always take precedence.
 	maxHeaderListSize := defaultServerMaxHeaderListSize
+	if envconfig.Enable8KBDefaultHeaderListSize {
+		maxHeaderListSize = upcomingDefaultHeaderListSize
+	}
 	if config.MaxHeaderListSize != nil {
 		maxHeaderListSize = *config.MaxHeaderListSize
 	}
@@ -399,7 +407,7 @@
 		st:               t,
 		headerWireLength: int(frame.Header().Length),
 	}
-	s.Stream.buf.init()
+	s.Stream.buf.init(t.bufferPool)
 	var (
 		// if false, content-type was missing or invalid
 		isGRPC      = false
@@ -802,7 +810,10 @@
 		dataLen := f.data.Len()
 		if f.Header().Flags.Has(http2.FlagDataPadded) {
 			if w := s.fc.onRead(size - uint32(dataLen)); w > 0 {
-				t.controlBuf.put(&outgoingWindowUpdate{s.id, w})
+				t.controlBuf.put(&outgoingWindowUpdate{
+					streamID:  s.id,
+					increment: w,
+				})
 			}
 		}
 		if dataLen > 0 {
@@ -948,8 +959,8 @@
 			return false
 		}
 	}
-	if sz > int64(upcomingDefaultHeaderListSize) {
-		t.logger.Warningf("Header list size to send (%d bytes) is larger than the upcoming default limit (%d bytes). In a future release, this will be restricted to %d bytes.", sz, upcomingDefaultHeaderListSize, upcomingDefaultHeaderListSize)
+	if !envconfig.Enable8KBDefaultHeaderListSize && sz > int64(upcomingDefaultHeaderListSize) {
+		t.logger.Warningf("Header list size to send (%d bytes) is larger than the upcoming default limit (%d bytes). In release v1.82.0, GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE will be enabled by default, enforcing this limit.", sz, upcomingDefaultHeaderListSize)
 	}
 	return true
 }
@@ -1039,7 +1050,7 @@
 		headerFields = append(headerFields, hpack.HeaderField{Name: "grpc-encoding", Value: s.sendCompress})
 	}
 	headerFields = appendHeaderFieldsFromMD(headerFields, s.header)
-	hf := &headerFrame{
+	hf := &serverHeaders{
 		streamID:  s.id,
 		hf:        headerFields,
 		endStream: false,
@@ -1107,7 +1118,7 @@
 
 	// Attach the trailer metadata.
 	headerFields = appendHeaderFieldsFromMD(headerFields, s.trailer)
-	trailingHeader := &headerFrame{
+	trailingHeader := &serverHeaders{
 		streamID:  s.id,
 		hf:        headerFields,
 		endStream: true,
@@ -1317,7 +1328,7 @@
 }
 
 // finishStream closes the stream and puts the trailing headerFrame into controlbuf.
-func (t *http2Server) finishStream(s *ServerStream, rst bool, rstCode http2.ErrCode, hdr *headerFrame, eosReceived bool) {
+func (t *http2Server) finishStream(s *ServerStream, rst bool, rstCode http2.ErrCode, hdr *serverHeaders, eosReceived bool) {
 	// In case stream sending and receiving are invoked in separate
 	// goroutines (e.g., bi-directional streaming), cancel needs to be
 	// called to interrupt the potential blocking on other goroutines.
@@ -1441,14 +1452,14 @@
 func (t *http2Server) incrMsgSent() {
 	if channelz.IsOn() {
 		t.channelz.SocketMetrics.MessagesSent.Add(1)
-		t.channelz.SocketMetrics.LastMessageSentTimestamp.Add(1)
+		t.channelz.SocketMetrics.LastMessageSentTimestamp.Store(transportinternal.TimeNowFunc())
 	}
 }
 
 func (t *http2Server) incrMsgRecv() {
 	if channelz.IsOn() {
 		t.channelz.SocketMetrics.MessagesReceived.Add(1)
-		t.channelz.SocketMetrics.LastMessageReceivedTimestamp.Add(1)
+		t.channelz.SocketMetrics.LastMessageReceivedTimestamp.Store(transportinternal.TimeNowFunc())
 	}
 }
 
@@ -1456,7 +1467,7 @@
 	resp := make(chan uint32, 1)
 	timer := time.NewTimer(time.Second)
 	defer timer.Stop()
-	t.controlBuf.put(&outFlowControlSizeRequest{resp})
+	t.controlBuf.put(&outFlowControlSizeRequest{resp: resp})
 	select {
 	case sz := <-resp:
 		return int64(sz)
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/internal/transport/internal/internal.go /work/src/external-provisioner/vendor/google.golang.org/grpc/internal/transport/internal/internal.go
--- a/vendor/google.golang.org/grpc/internal/transport/internal/internal.go	1970-01-01 00:00:00.000000000 +0000
+++ b/vendor/google.golang.org/grpc/internal/transport/internal/internal.go	2026-09-05 00:03:04.682980966 +0000
@@ -0,0 +1,25 @@
+/*
+ *
+ * Copyright 2026 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+// Package internal contains functionality internal to the transport package.
+package internal
+
+// TimeNowFunc is a variable that can be set to override the default behavior of
+// getting the current time in nanoseconds. It is used in transport code to set
+// channelz timestamps, and is exposed here for testing purposes.
+var TimeNowFunc func() int64
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/internal/transport/transport.go /work/src/external-provisioner/vendor/google.golang.org/grpc/internal/transport/transport.go
--- a/vendor/google.golang.org/grpc/internal/transport/transport.go	2026-09-05 00:02:32.226805114 +0000
+++ b/vendor/google.golang.org/grpc/internal/transport/transport.go	2026-09-05 00:03:04.682980966 +0000
@@ -30,11 +30,15 @@
 	"sync"
 	"sync/atomic"
 	"time"
+	"unsafe"
 
 	"golang.org/x/net/http2"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/internal/channelz"
+	"google.golang.org/grpc/internal/envconfig"
+	imem "google.golang.org/grpc/internal/mem"
+	"google.golang.org/grpc/internal/transport/internal"
 	"google.golang.org/grpc/keepalive"
 	"google.golang.org/grpc/mem"
 	"google.golang.org/grpc/metadata"
@@ -44,7 +48,34 @@
 	"google.golang.org/grpc/tap"
 )
 
-const logLevel = 2
+const (
+	logLevel = 2
+	// recvMsgSize estimates the memory overhead of a recvMsg in the backlog.
+	// It accounts for the recvMsg struct itself and the slice header of the
+	// underlying buffer's data.
+	recvMsgSize = int(unsafe.Sizeof(recvMsg{}) + unsafe.Sizeof([]byte{}))
+
+	// utilizationFactor controls when we consider memory utilization acceptable.
+	// When backlogHeapSize / payloadSize <= utilizationFactor (meaning at least
+	// 50% of the heap memory is actual payload data), compaction is skipped.
+	utilizationFactor = 2
+)
+
+var (
+	// compactionThreshold is approx 57KB (on 64-bit systems). It allows
+	// accumulating up to 1024 1-byte payloads before triggering compaction.
+	//
+	// Because individual payloads <= 1024 bytes are allocated on the heap
+	// outside mem.BufferPool, waiting for at least 1024 bytes to accumulate
+	// ensures that compaction coalesces those small heap allocations into a
+	// single large buffer from mem.BufferPool, enabling buffer reuse while
+	// avoiding frequent copying for small bursts of frames.
+	compactionThreshold = imem.BufferPoolingThreshold * (recvMsgSize + 1)
+)
+
+func init() {
+	internal.TimeNowFunc = func() int64 { return time.Now().UnixNano() }
+}
 
 // recvMsg represents the received msg from the transport. All transport
 // protocol specific info has been removed.
@@ -66,23 +97,31 @@
 	c       chan recvMsg
 	mu      sync.Mutex
 	backlog []recvMsg
-	err     error
+	// uncompactedSuffixLen tracks the number of consecutive data messages at
+	// the tail of backlog that have not been compacted.
+	uncompactedSuffixLen int
+	// uncompactedBytes tracks the total payload bytes across the trailing
+	// uncompactedSuffixLen messages.
+	uncompactedBytes int
+	err              error
+	bufPool          mem.BufferPool
 }
 
 // init allows a recvBuffer to be initialized in-place, which is useful
 // for resetting a buffer or for avoiding a heap allocation when the buffer
 // is embedded in another struct.
-func (b *recvBuffer) init() {
+func (b *recvBuffer) init(pool mem.BufferPool) {
 	b.c = make(chan recvMsg, 1)
+	b.bufPool = pool
 }
 
 func (b *recvBuffer) put(r recvMsg) {
 	b.mu.Lock()
+	defer b.mu.Unlock()
 	if b.err != nil {
 		// drop the buffer on the floor. Since b.err is not nil, any subsequent reads
 		// will always return an error, making this buffer inaccessible.
 		r.buffer.Free()
-		b.mu.Unlock()
 		// An error had occurred earlier, don't accept more
 		// data or errors.
 		return
@@ -91,13 +130,70 @@
 	if len(b.backlog) == 0 {
 		select {
 		case b.c <- r:
-			b.mu.Unlock()
 			return
 		default:
 		}
 	}
 	b.backlog = append(b.backlog, r)
-	b.mu.Unlock()
+	b.compactBacklogLocked(r)
+}
+
+func (b *recvBuffer) compactBacklogLocked(r recvMsg) {
+	if !envconfig.EnableReceiveBufferCompaction {
+		return
+	}
+	if r.buffer == nil {
+		b.uncompactedBytes = 0
+		b.uncompactedSuffixLen = 0
+		return
+	}
+
+	b.uncompactedSuffixLen++
+	b.uncompactedBytes += r.buffer.Len()
+	backlogHeapSize := b.uncompactedSuffixLen*recvMsgSize + b.uncompactedBytes
+
+	// If the memory overhead is less than 50% of the heap usage (e.g., because
+	// a large DATA frame arrived), the average message size in the suffix is
+	// large enough that memory bloat is not a concern. Reset suffix tracking.
+	if backlogHeapSize <= utilizationFactor*b.uncompactedBytes {
+		b.uncompactedBytes = 0
+		b.uncompactedSuffixLen = 0
+		return
+	}
+	// Avoid compacting too frequently for short bursts of small frames.
+	// Wait until we have accumulated at least ~1024 small messages (~57 KB).
+	if backlogHeapSize <= compactionThreshold {
+		// Still can accumulate more payloads.
+		return
+	}
+
+	// Since the memory utilization is less than 50%, the average payload size
+	// of each recvMsg must be less than recvMsgSize (approx 56 bytes).
+	// In the worst case for bytes copied (where the average payload is just
+	// below recvMsgSize), compaction will occur once every:
+	//   compactionThreshold / (recvMsgSize + avg_payload) = ~520 messages,
+	// copying ~29KB of data.
+
+	start := 0
+	newBuf := b.bufPool.Get(b.uncompactedBytes)
+	startIdx := len(b.backlog) - b.uncompactedSuffixLen
+
+	for i := startIdx; i < len(b.backlog); i++ {
+		m := b.backlog[i]
+		b.backlog[i] = recvMsg{}
+		start += copy((*newBuf)[start:], m.buffer.ReadOnlyData())
+		m.buffer.Free()
+	}
+	b.backlog[startIdx] = recvMsg{
+		buffer: mem.NewBuffer(newBuf, b.bufPool),
+	}
+	b.backlog = b.backlog[:startIdx+1]
+	// After compaction, the suffix is replaced with a single message containing
+	// the combined payload. The new utilization is close to 1.0 (overhead of
+	// one recvMsg relative to the large compacted payload), which is well
+	// below the utilization factor of 2.
+	b.uncompactedBytes = 0
+	b.uncompactedSuffixLen = 0
 }
 
 func (b *recvBuffer) load() {
@@ -105,6 +201,13 @@
 	if len(b.backlog) > 0 {
 		select {
 		case b.c <- b.backlog[0]:
+			// backlog[0] is only part of the tracked uncompacted suffix if the
+			// entire backlog currently consists of the suffix. If an earlier
+			// compaction or reset occurred, backlog[0] is already compacted.
+			if envconfig.EnableReceiveBufferCompaction && b.uncompactedSuffixLen == len(b.backlog) {
+				b.uncompactedSuffixLen--
+				b.uncompactedBytes -= b.backlog[0].buffer.Len()
+			}
 			b.backlog[0] = recvMsg{}
 			b.backlog = b.backlog[1:]
 		default:
@@ -589,8 +692,6 @@
 
 	PreviousAttempts int // value of grpc-previous-rpc-attempts header to set
 
-	DoneFunc func() // called when the stream is finished
-
 	// Authority is used to explicitly override the `:authority` header.
 	//
 	// This value comes from one of two sources:
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/mem/buffer_pool.go /work/src/external-provisioner/vendor/google.golang.org/grpc/mem/buffer_pool.go
--- a/vendor/google.golang.org/grpc/mem/buffer_pool.go	2026-09-05 00:02:32.226805114 +0000
+++ b/vendor/google.golang.org/grpc/mem/buffer_pool.go	2026-09-05 00:03:04.686980987 +0000
@@ -59,10 +59,6 @@
 	internal.SetDefaultBufferPool = func(pool BufferPool) {
 		defaultBufferPool = pool
 	}
-
-	internal.SetBufferPoolingThresholdForTesting = func(threshold int) {
-		bufferPoolingThreshold = threshold
-	}
 }
 
 // DefaultBufferPool returns the current default buffer pool. It is a BufferPool
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/mem/buffers.go /work/src/external-provisioner/vendor/google.golang.org/grpc/mem/buffers.go
--- a/vendor/google.golang.org/grpc/mem/buffers.go	2026-09-05 00:02:32.226805114 +0000
+++ b/vendor/google.golang.org/grpc/mem/buffers.go	2026-09-05 00:03:04.686980987 +0000
@@ -29,6 +29,8 @@
 	"fmt"
 	"sync"
 	"sync/atomic"
+
+	"google.golang.org/grpc/internal/mem"
 )
 
 // A Buffer represents a reference counted piece of data (in bytes) that can be
@@ -63,8 +65,6 @@
 }
 
 var (
-	bufferPoolingThreshold = 1 << 10
-
 	bufferObjectPool = sync.Pool{New: func() any { return new(buffer) }}
 )
 
@@ -72,7 +72,7 @@
 // equal to the threshold for buffer pooling. This is used to determine whether
 // to pool buffers or allocate them directly.
 func IsBelowBufferPoolingThreshold(size int) bool {
-	return size <= bufferPoolingThreshold
+	return size <= mem.BufferPoolingThreshold
 }
 
 type buffer struct {
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/reflection/grpc_reflection_v1/reflection_grpc.pb.go /work/src/external-provisioner/vendor/google.golang.org/grpc/reflection/grpc_reflection_v1/reflection_grpc.pb.go
--- a/vendor/google.golang.org/grpc/reflection/grpc_reflection_v1/reflection_grpc.pb.go	2026-09-05 00:02:32.226805114 +0000
+++ b/vendor/google.golang.org/grpc/reflection/grpc_reflection_v1/reflection_grpc.pb.go	2026-09-05 00:03:04.686980987 +0000
@@ -21,7 +21,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.6.1
+// - protoc-gen-go-grpc v1.6.2
 // - protoc             v5.27.1
 // source: grpc/reflection/v1/reflection.proto
 
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/reflection/grpc_reflection_v1alpha/reflection_grpc.pb.go /work/src/external-provisioner/vendor/google.golang.org/grpc/reflection/grpc_reflection_v1alpha/reflection_grpc.pb.go
--- a/vendor/google.golang.org/grpc/reflection/grpc_reflection_v1alpha/reflection_grpc.pb.go	2026-09-05 00:02:32.226805114 +0000
+++ b/vendor/google.golang.org/grpc/reflection/grpc_reflection_v1alpha/reflection_grpc.pb.go	2026-09-05 00:03:04.686980987 +0000
@@ -18,7 +18,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.6.1
+// - protoc-gen-go-grpc v1.6.2
 // - protoc             v5.27.1
 // grpc/reflection/v1alpha/reflection.proto is a deprecated file.
 
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/rpc_util.go /work/src/external-provisioner/vendor/google.golang.org/grpc/rpc_util.go
--- a/vendor/google.golang.org/grpc/rpc_util.go	2026-09-05 00:02:32.226805114 +0000
+++ b/vendor/google.golang.org/grpc/rpc_util.go	2026-09-05 00:03:04.662980865 +0000
@@ -128,6 +128,16 @@
 }
 
 func (d *gzipDecompressor) Do(r io.Reader) ([]byte, error) {
+	return d.doWithMaxSize(r, math.MaxInt64)
+}
+
+// doWithMaxSize behaves like Do but caps the size of the decompressed
+// payload at maxMessageSize+1 bytes. The Decompressor interface does not
+// allow extra parameters, so callers inside the package type-assert to
+// *gzipDecompressor to invoke this method directly. The +1 byte makes it
+// possible for the caller to detect that the limit was exceeded and
+// return ResourceExhausted instead of materializing an unbounded payload.
+func (d *gzipDecompressor) doWithMaxSize(r io.Reader, maxMessageSize int64) ([]byte, error) {
 	var z *gzip.Reader
 	switch maybeZ := d.pool.Get().(type) {
 	case nil:
@@ -148,7 +158,11 @@
 		z.Close()
 		d.pool.Put(z)
 	}()
-	return io.ReadAll(z)
+	var src io.Reader = z
+	if maxMessageSize < math.MaxInt64 {
+		src = io.LimitReader(z, maxMessageSize+1)
+	}
+	return io.ReadAll(src)
 }
 
 func (d *gzipDecompressor) Type() string {
@@ -830,15 +844,15 @@
 	if compressor != nil {
 		z, err := compressor.Compress(w)
 		if err != nil {
-			return nil, 0, wrapErr(err)
+			return nil, compressionNone, wrapErr(err)
 		}
 		for _, b := range in {
 			if _, err := z.Write(b.ReadOnlyData()); err != nil {
-				return nil, 0, wrapErr(err)
+				return nil, compressionNone, wrapErr(err)
 			}
 		}
 		if err := z.Close(); err != nil {
-			return nil, 0, wrapErr(err)
+			return nil, compressionNone, wrapErr(err)
 		}
 	} else {
 		// This is obviously really inefficient since it fully materializes the data, but
@@ -848,7 +862,7 @@
 		buf := in.MaterializeToBuffer(pool)
 		defer buf.Free()
 		if err := cp.Do(w, buf.ReadOnlyData()); err != nil {
-			return nil, 0, wrapErr(err)
+			return nil, compressionNone, wrapErr(err)
 		}
 	}
 	return out, compressionMade, nil
@@ -971,7 +985,20 @@
 func decompress(compressor encoding.Compressor, d mem.BufferSlice, dc Decompressor, maxReceiveMessageSize int, pool mem.BufferPool) (mem.BufferSlice, error) {
 	if dc != nil {
 		r := d.Reader()
-		uncompressed, err := dc.Do(r)
+		// For the built-in gzip decompressor, bound the decompressed output
+		// at maxReceiveMessageSize+1 so that a small but highly compressed
+		// payload (a "zip bomb") cannot expand to gigabytes in memory before
+		// the post-decompression size check below has a chance to fire. The
+		// Decompressor interface does not accept an extra size parameter,
+		// so we type-assert to invoke a size-aware helper. Third-party
+		// Decompressor implementations keep the original Do behavior.
+		var uncompressed []byte
+		var err error
+		if gd, ok := dc.(*gzipDecompressor); ok {
+			uncompressed, err = gd.doWithMaxSize(r, int64(maxReceiveMessageSize))
+		} else {
+			uncompressed, err = dc.Do(r)
+		}
 		if err != nil {
 			r.Close() // ensure buffers are reused
 			return nil, status.Errorf(codes.Internal, "grpc: failed to decompress the received message: %v", err)
@@ -989,6 +1016,9 @@
 			r.Close() // ensure buffers are reused
 			return nil, status.Errorf(codes.Internal, "grpc: failed to decompress the message: %v", err)
 		}
+		if closer, ok := dcReader.(io.Closer); ok {
+			defer closer.Close()
+		}
 
 		// Read at most one byte more than the limit from the decompressor.
 		// Unless the limit is MaxInt64, in which case, that's impossible, so
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/server.go /work/src/external-provisioner/vendor/google.golang.org/grpc/server.go
--- a/vendor/google.golang.org/grpc/server.go	2026-09-05 00:02:32.226805114 +0000
+++ b/vendor/google.golang.org/grpc/server.go	2026-09-05 00:03:04.662980865 +0000
@@ -28,6 +28,7 @@
 	"net/http"
 	"reflect"
 	"runtime"
+	"runtime/pprof"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -150,8 +151,6 @@
 
 	serverWorkerChannel      chan func()
 	serverWorkerChannelClose func()
-
-	strictPathCheckingLogEmitted atomic.Bool
 }
 
 type serverOptions struct {
@@ -250,10 +249,8 @@
 // If this option is set to true every connection will release the buffer after
 // flushing the data on the wire.
 //
-// # Experimental
-//
-// Notice: This API is EXPERIMENTAL and may be changed or removed in a
-// later release.
+// Deprecated: shared write buffer is enabled by default. SharedWriteBuffer
+// will be removed in a future release.
 func SharedWriteBuffer(val bool) ServerOption {
 	return newFuncServerOption(func(o *serverOptions) {
 		o.sharedWriteBuffer = val
@@ -302,6 +299,14 @@
 // window size to the value provided and disables dynamic flow control.
 // The lower bound for window size is 64K and any value smaller than that
 // will be ignored.
+//
+// Note that this also disables dynamic flow control for the connection,
+// falling back to a default static connection-level window of 64KB. To
+// use a larger connection-level window, you must also use the
+// [StaticConnWindowSize] ServerOption.
+//
+// Most users should not configure static flow control windows unless
+// operating in a memory-constrained environment.
 func StaticStreamWindowSize(s int32) ServerOption {
 	return newFuncServerOption(func(o *serverOptions) {
 		o.initialWindowSize = s
@@ -313,6 +318,14 @@
 // window size to the value provided and disables dynamic flow control.
 // The lower bound for window size is 64K and any value smaller than that
 // will be ignored.
+//
+// Note that this also disables dynamic flow control for individual streams,
+// falling back to a default static connection-level window of 64KB. To
+// explicitly configure the stream-level window size, you must also use the
+// [StaticStreamWindowSize] ServerOption.
+//
+// Most users should not configure static flow control windows unless
+// operating in a memory-constrained environment.
 func StaticConnWindowSize(s int32) ServerOption {
 	return newFuncServerOption(func(o *serverOptions) {
 		o.initialConnWindowSize = s
@@ -1787,6 +1800,12 @@
 func (s *Server) handleStream(t transport.ServerTransport, stream *transport.ServerStream) {
 	ctx := stream.Context()
 	ctx = contextWithServer(ctx, s)
+	if envconfig.LabelServerGoroutines&envconfig.GoroutineLabelServerMethod != 0 {
+		// This method always runs in its own goroutine, so we can set a
+		// goroutine label without needing to restore a previous context.
+		ctx = pprof.WithLabels(ctx, pprof.Labels("grpc.method", stream.Method()))
+		pprof.SetGoroutineLabels(ctx)
+	}
 	var ti *traceInfo
 	if EnableTracing {
 		tr := newTrace("grpc.Recv."+methodFamily(stream.Method()), stream.Method())
@@ -1803,28 +1822,11 @@
 		}
 	}
 
-	sm := stream.Method()
-	if sm == "" {
+	sm, found := strings.CutPrefix(stream.Method(), "/")
+	if !found {
 		s.handleMalformedMethodName(stream, ti)
 		return
 	}
-	if sm[0] != '/' {
-		// TODO(easwars): Add a link to the CVE in the below log messages once
-		// published.
-		if envconfig.DisableStrictPathChecking {
-			if old := s.strictPathCheckingLogEmitted.Swap(true); !old {
-				channelz.Warningf(logger, s.channelz, "grpc: Server.handleStream received malformed method name %q. Allowing it because the environment variable GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING is set to true, but this option will be removed in a future release.", sm)
-			}
-		} else {
-			if old := s.strictPathCheckingLogEmitted.Swap(true); !old {
-				channelz.Warningf(logger, s.channelz, "grpc: Server.handleStream rejected malformed method name %q. To temporarily allow such requests, set the environment variable GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING to true. Note that this is not recommended as it may allow requests to bypass security policies.", sm)
-			}
-			s.handleMalformedMethodName(stream, ti)
-			return
-		}
-	} else {
-		sm = sm[1:]
-	}
 	pos := strings.LastIndex(sm, "/")
 	if pos == -1 {
 		s.handleMalformedMethodName(stream, ti)
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/stream.go /work/src/external-provisioner/vendor/google.golang.org/grpc/stream.go
--- a/vendor/google.golang.org/grpc/stream.go	2026-09-05 00:02:32.226805114 +0000
+++ b/vendor/google.golang.org/grpc/stream.go	2026-09-05 00:03:04.662980865 +0000
@@ -201,6 +201,15 @@
 	}
 }
 
+// clientInterceptor is structurally identical to the ClientInterceptor defined
+// in internal/xds/httpfilter/httpfilter.go. It is defined locally here so that
+// we can type-assert the generic Interceptor field in iresolver.RPCConfig
+// without introducing a dependency on xDS packages.
+type clientInterceptor interface {
+	NewStream(ctx context.Context, ri iresolver.RPCInfo, newStream func(ctx context.Context, opts ...CallOption) (ClientStream, error), opts ...CallOption) (ClientStream, error)
+	Close()
+}
+
 func newClientStream(ctx context.Context, desc *StreamDesc, cc *ClientConn, method string, opts ...CallOption) (_ ClientStream, err error) {
 	if channelz.IsOn() {
 		cc.incrCallsStarted()
@@ -244,8 +253,11 @@
 
 	mc := &emptyMethodConfig
 	var onCommit func()
-	newStream := func(ctx context.Context, done func()) (iresolver.ClientStream, error) {
-		return newClientStreamWithParams(ctx, desc, cc, method, mc, onCommit, done, nameResolutionDelayed, opts...)
+	newStream := func(ctx context.Context, filterOpts ...CallOption) (ClientStream, error) {
+		if filterOpts != nil {
+			opts = combine(opts, filterOpts)
+		}
+		return newClientStreamWithParams(ctx, desc, cc, method, mc, onCommit, nameResolutionDelayed, opts...)
 	}
 
 	rpcInfo := iresolver.RPCInfo{Context: ctx, Method: method}
@@ -270,20 +282,24 @@
 		if rpcConfig.Interceptor != nil {
 			rpcInfo.Context = nil
 			ns := newStream
-			newStream = func(ctx context.Context, done func()) (iresolver.ClientStream, error) {
-				cs, err := rpcConfig.Interceptor.NewStream(ctx, rpcInfo, done, ns)
-				if err != nil {
-					return nil, toRPCErr(err)
+			if interceptor, ok := rpcConfig.Interceptor.(clientInterceptor); ok {
+				newStream = func(ctx context.Context, filterOpts ...CallOption) (ClientStream, error) {
+					cs, err := interceptor.NewStream(ctx, rpcInfo, ns, filterOpts...)
+					if err != nil {
+						return nil, toRPCErr(err)
+					}
+					return cs, nil
 				}
-				return cs, nil
+			} else {
+				return nil, status.Errorf(codes.Internal, "invalid client interceptor type %T", rpcConfig.Interceptor)
 			}
 		}
 	}
 
-	return newStream(ctx, func() {})
+	return newStream(ctx)
 }
 
-func newClientStreamWithParams(ctx context.Context, desc *StreamDesc, cc *ClientConn, method string, mc *serviceconfig.MethodConfig, onCommit, doneFunc func(), nameResolutionDelayed bool, opts ...CallOption) (_ iresolver.ClientStream, err error) {
+func newClientStreamWithParams(ctx context.Context, desc *StreamDesc, cc *ClientConn, method string, mc *serviceconfig.MethodConfig, onCommit func(), nameResolutionDelayed bool, opts ...CallOption) (_ ClientStream, err error) {
 	callInfo := defaultCallInfo()
 	if mc.WaitForReady != nil {
 		callInfo.failFast = !*mc.WaitForReady
@@ -321,7 +337,6 @@
 		Host:           cc.authority,
 		Method:         method,
 		ContentSubtype: callInfo.contentSubtype,
-		DoneFunc:       doneFunc,
 		Authority:      callInfo.authority,
 	}
 	if allowed := callInfo.acceptedResponseCompressors; len(allowed) > 0 {
diff -Nur /work/src-orig/external-provisioner/vendor/google.golang.org/grpc/version.go /work/src/external-provisioner/vendor/google.golang.org/grpc/version.go
--- a/vendor/google.golang.org/grpc/version.go	2026-09-05 00:02:32.226805114 +0000
+++ b/vendor/google.golang.org/grpc/version.go	2026-09-05 00:03:04.662980865 +0000
@@ -19,4 +19,4 @@
 package grpc
 
 // Version is the current grpc version.
-const Version = "1.81.1"
+const Version = "1.83.1"
diff -Nur /work/src-orig/external-provisioner/vendor/modules.txt /work/src/external-provisioner/vendor/modules.txt
--- a/vendor/modules.txt	2026-09-05 00:02:32.554806738 +0000
+++ b/vendor/modules.txt	2026-09-05 00:03:05.658985947 +0000
@@ -147,7 +147,7 @@
 # github.com/golang/protobuf v1.5.4
 ## explicit; go 1.17
 github.com/golang/protobuf/proto
-# github.com/google/cel-go v0.27.0
+# github.com/google/cel-go v0.27.0 => github.com/google/cel-go v0.29.0
 ## explicit; go 1.23.0
 github.com/google/cel-go/cel
 github.com/google/cel-go/checker
@@ -477,8 +477,8 @@
 # go.yaml.in/yaml/v3 v3.0.4
 ## explicit; go 1.16
 go.yaml.in/yaml/v3
-# golang.org/x/crypto v0.52.0
-## explicit; go 1.25.0
+# golang.org/x/crypto v0.53.0 => golang.org/x/crypto v0.56.0
+## explicit; go 1.26.0
 golang.org/x/crypto/blowfish
 golang.org/x/crypto/chacha20
 golang.org/x/crypto/cryptobyte
@@ -491,10 +491,10 @@
 # golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa
 ## explicit; go 1.25.0
 golang.org/x/exp/slices
-# golang.org/x/mod v0.36.0
+# golang.org/x/mod v0.37.0
 ## explicit; go 1.25.0
 golang.org/x/mod/semver
-# golang.org/x/net v0.55.0
+# golang.org/x/net v0.57.0 => golang.org/x/net v0.56.0
 ## explicit; go 1.25.0
 golang.org/x/net/bpf
 golang.org/x/net/html
@@ -519,21 +519,21 @@
 ## explicit; go 1.25.0
 golang.org/x/oauth2
 golang.org/x/oauth2/internal
-# golang.org/x/sync v0.20.0
+# golang.org/x/sync v0.21.0
 ## explicit; go 1.25.0
 golang.org/x/sync/errgroup
 golang.org/x/sync/singleflight
-# golang.org/x/sys v0.45.0
+# golang.org/x/sys v0.47.0
 ## explicit; go 1.25.0
 golang.org/x/sys/cpu
 golang.org/x/sys/plan9
 golang.org/x/sys/unix
 golang.org/x/sys/windows
 golang.org/x/sys/windows/registry
-# golang.org/x/term v0.43.0
+# golang.org/x/term v0.45.0
 ## explicit; go 1.25.0
 golang.org/x/term
-# golang.org/x/text v0.37.0
+# golang.org/x/text v0.41.0 => golang.org/x/text v0.39.0
 ## explicit; go 1.25.0
 golang.org/x/text/cases
 golang.org/x/text/encoding
@@ -567,7 +567,7 @@
 # golang.org/x/time v0.15.0
 ## explicit; go 1.25.0
 golang.org/x/time/rate
-# golang.org/x/tools v0.45.0
+# golang.org/x/tools v0.47.0
 ## explicit; go 1.25.0
 golang.org/x/tools/cover
 golang.org/x/tools/go/ast/edge
@@ -599,7 +599,7 @@
 ## explicit; go 1.25.0
 google.golang.org/genproto/googleapis/rpc/errdetails
 google.golang.org/genproto/googleapis/rpc/status
-# google.golang.org/grpc v1.81.1
+# google.golang.org/grpc v1.81.1 => google.golang.org/grpc v1.83.1
 ## explicit; go 1.25.0
 google.golang.org/grpc
 google.golang.org/grpc/attributes
@@ -621,6 +621,7 @@
 google.golang.org/grpc/encoding/gzip
 google.golang.org/grpc/encoding/internal
 google.golang.org/grpc/encoding/proto
+google.golang.org/grpc/experimental/balancer/weight
 google.golang.org/grpc/experimental/stats
 google.golang.org/grpc/grpclog
 google.golang.org/grpc/grpclog/internal
@@ -628,7 +629,6 @@
 google.golang.org/grpc/internal
 google.golang.org/grpc/internal/backoff
 google.golang.org/grpc/internal/balancer/gracefulswitch
-google.golang.org/grpc/internal/balancer/weight
 google.golang.org/grpc/internal/balancerload
 google.golang.org/grpc/internal/binarylog
 google.golang.org/grpc/internal/buffer
@@ -654,6 +654,7 @@
 google.golang.org/grpc/internal/status
 google.golang.org/grpc/internal/syscall
 google.golang.org/grpc/internal/transport
+google.golang.org/grpc/internal/transport/internal
 google.golang.org/grpc/internal/transport/networktype
 google.golang.org/grpc/internal/transport/readyreader
 google.golang.org/grpc/keepalive
@@ -1658,3 +1659,8 @@
 # k8s.io/cri-streaming => k8s.io/cri-streaming v0.36.1
 # k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.36.1
 # k8s.io/streaming => k8s.io/streaming v0.36.1
+# github.com/google/cel-go => github.com/google/cel-go v0.29.0
+# golang.org/x/crypto => golang.org/x/crypto v0.56.0
+# golang.org/x/net => golang.org/x/net v0.56.0
+# golang.org/x/text => golang.org/x/text v0.39.0
+# google.golang.org/grpc => google.golang.org/grpc v1.83.1
