vendor: update buildkit to v0.30.0-rc1

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2026-05-06 15:06:54 -07:00
parent 0439d7fe8e
commit a3147eba54
222 changed files with 7928 additions and 2565 deletions
@@ -4,7 +4,7 @@ import (
 	"github.com/moby/buildkit/util/tracing/detect"
 	"go.opentelemetry.io/otel"
-	_ "github.com/moby/buildkit/util/tracing/env"
+	_ "github.com/moby/buildkit/util/tracing/childprocess"
 )
 func init() {
@@ -6,10 +6,10 @@ require (
 	github.com/Masterminds/semver/v3 v3.4.0
 	github.com/Microsoft/go-winio v0.6.2
 	github.com/ProtonMail/go-crypto v1.3.0
-	github.com/aws/aws-sdk-go-v2/config v1.32.12
+	github.com/aws/aws-sdk-go-v2/config v1.32.17
 	github.com/compose-spec/compose-go/v2 v2.10.2
 	github.com/containerd/console v1.0.5
-	github.com/containerd/containerd/v2 v2.2.2
+	github.com/containerd/containerd/v2 v2.2.3
 	github.com/containerd/continuity v0.4.5
 	github.com/containerd/errdefs v1.0.0
 	github.com/containerd/log v0.1.0
@@ -17,7 +17,7 @@ require (
 	github.com/creack/pty v1.1.24
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
 	github.com/distribution/reference v0.6.0
-	github.com/docker/cli v29.4.1+incompatible
+	github.com/docker/cli v29.4.2+incompatible
 	github.com/docker/cli-docs-tool v0.11.0
 	github.com/docker/docker v28.5.2+incompatible
 	github.com/docker/go-units v0.5.0
@@ -28,9 +28,9 @@ require (
 	github.com/google/uuid v1.6.0
 	github.com/hashicorp/go-cty-funcs v0.0.0-20250818135842-6aab67130928
 	github.com/hashicorp/hcl/v2 v2.24.0
-	github.com/in-toto/in-toto-golang v0.10.0
+	github.com/in-toto/in-toto-golang v0.11.0
 	github.com/mitchellh/hashstructure/v2 v2.0.2
-	github.com/moby/buildkit v0.29.1-0.20260408185135-a243ce438aee
+	github.com/moby/buildkit v0.30.0-rc1
 	github.com/moby/go-archive v0.2.0
 	github.com/moby/moby/api v1.54.2
 	github.com/moby/moby/client v0.4.1
@@ -55,12 +55,12 @@ require (
 	github.com/tonistiigi/go-csvvalue v0.0.0-20240814133006-030d3b2625d0
 	github.com/tonistiigi/jaeger-ui-rest v0.0.0-20250408171107-3dd17559e117
 	github.com/zclconf/go-cty v1.17.0
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0
-	go.opentelemetry.io/otel v1.42.0
+	go.opentelemetry.io/otel v1.43.0
 	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.42.0
-	go.opentelemetry.io/otel/metric v1.42.0
+	go.opentelemetry.io/otel/metric v1.43.0
-	go.opentelemetry.io/otel/sdk v1.42.0
+	go.opentelemetry.io/otel/sdk v1.43.0
-	go.opentelemetry.io/otel/trace v1.42.0
+	go.opentelemetry.io/otel/trace v1.43.0
 	go.yaml.in/yaml/v3 v3.0.4
 	golang.org/x/crypto v0.49.0
 	golang.org/x/mod v0.34.0
@@ -68,8 +68,8 @@ require (
 	golang.org/x/sys v0.42.0
 	golang.org/x/term v0.41.0
 	golang.org/x/text v0.35.0
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d
-	google.golang.org/grpc v1.79.3
+	google.golang.org/grpc v1.80.0
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1
 	google.golang.org/protobuf v1.36.11
 	k8s.io/api v0.35.4
@@ -84,19 +84,19 @@ require (
 	github.com/apparentlymart/go-cidr v1.0.1 // indirect
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.41.4 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.41.7 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.12 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.16 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.20 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.20 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.20 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23 // indirect
-	github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.0.11 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.30.17 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.21 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.42.1 // indirect
-	github.com/aws/smithy-go v1.24.2 // indirect
+	github.com/aws/smithy-go v1.25.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/blang/semver v3.5.1+incompatible // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
@@ -156,7 +156,7 @@ require (
 	github.com/in-toto/attestation v1.1.2 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/klauspost/compress v1.18.5 // indirect
+	github.com/klauspost/compress v1.18.6 // indirect
 	github.com/lestrrat-go/blackmagic v1.0.4 // indirect
 	github.com/lestrrat-go/dsig v1.0.0 // indirect
 	github.com/lestrrat-go/dsig-secp256k1 v1.0.0 // indirect
@@ -214,22 +214,22 @@ require (
 	github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
 	github.com/yashtewari/glob-intersection v0.2.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.67.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.68.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.42.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.9.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v4 v4.0.0-rc.4 // indirect
 	golang.org/x/net v0.52.0 // indirect
 	golang.org/x/oauth2 v0.35.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	golang.org/x/tools v0.42.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260406210006-6f92a3bedf2d // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
@@ -38,8 +38,8 @@ github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1
 github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
-github.com/Microsoft/hcsshim v0.14.0-rc.1 h1:qAPXKwGOkVn8LlqgBN8GS0bxZ83hOJpcjxzmlQKxKsQ=
+github.com/Microsoft/hcsshim v0.14.1 h1:CMuB3fqQVfPdhyXhUqYdUmPUIOhJkmghCx3dJet8Cqs=
-github.com/Microsoft/hcsshim v0.14.0-rc.1/go.mod h1:hTKFGbnDtQb1wHiOWv4v0eN+7boSWAHyK/tNAaYZL0c=
+github.com/Microsoft/hcsshim v0.14.1/go.mod h1:VnzvPLyWUhxiPVsJ31P6XadxCcTogTguBFDy/1GR/OM=
 github.com/ProtonMail/go-crypto v1.3.0 h1:ILq8+Sf5If5DCpHQp4PbZdS1J7HDFRXz/+xKBiRGFrw=
 github.com/ProtonMail/go-crypto v1.3.0/go.mod h1:9whxjD8Rbs29b4XWbB8irEcE8KHMqaR2e7GWU1R+/PE=
 github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7lmo=
@@ -64,36 +64,36 @@ github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3d
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/aws/aws-sdk-go v1.55.7 h1:UJrkFq7es5CShfBwlWAC8DA077vp8PyVbQd3lqLiztE=
 github.com/aws/aws-sdk-go v1.55.7/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
-github.com/aws/aws-sdk-go-v2 v1.41.4 h1:10f50G7WyU02T56ox1wWXq+zTX9I1zxG46HYuG1hH/k=
+github.com/aws/aws-sdk-go-v2 v1.41.7 h1:DWpAJt66FmnnaRIOT/8ASTucrvuDPZASqhhLey6tLY8=
-github.com/aws/aws-sdk-go-v2 v1.41.4/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
+github.com/aws/aws-sdk-go-v2 v1.41.7/go.mod h1:4LAfZOPHNVNQEckOACQx60Y8pSRjIkNZQz1w92xpMJc=
-github.com/aws/aws-sdk-go-v2/config v1.32.12 h1:O3csC7HUGn2895eNrLytOJQdoL2xyJy0iYXhoZ1OmP0=
+github.com/aws/aws-sdk-go-v2/config v1.32.17 h1:FpL4/758/diKwqbytU0prpuiu60fgXKUWCpDJtApclU=
-github.com/aws/aws-sdk-go-v2/config v1.32.12/go.mod h1:96zTvoOFR4FURjI+/5wY1vc1ABceROO4lWgWJuxgy0g=
+github.com/aws/aws-sdk-go-v2/config v1.32.17/go.mod h1:OXqUMzgXytfoF9JaKkhrOYsyh72t9G+MJH8mMRaexOE=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.12 h1:oqtA6v+y5fZg//tcTWahyN9PEn5eDU/Wpvc2+kJ4aY8=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.16 h1:r3RJBuU7X9ibt8RHbMjWE6y60QbKBiII6wSrXnapxSU=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.12/go.mod h1:U3R1RtSHx6NB0DvEQFGyf/0sbrpJrluENHdPy1j/3TE=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.16/go.mod h1:6cx7zqDENJDbBIIWX6P8s0h6hqHC8Avbjh9Dseo27ug=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 h1:zOgq3uezl5nznfoK3ODuqbhVg1JzAGDUhXOsU0IDCAo=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23 h1:UuSfcORqNSz/ey3VPRS8TcVH2Ikf0/sC+Hdj400QI6U=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20/go.mod h1:z/MVwUARehy6GAg/yQ1GO2IMl0k++cu1ohP9zo887wE=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23/go.mod h1:+G/OSGiOFnSOkYloKj/9M35s74LgVAdJBSD5lsFfqKg=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.20 h1:CNXO7mvgThFGqOFgbNAP2nol2qAWBOGfqR/7tQlvLmc=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 h1:GpT/TrnBYuE5gan2cZbTtvP+JlHsutdmlV2YfEyNde0=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.20/go.mod h1:oydPDJKcfMhgfcgBUZaG+toBbwy8yPWubJXBVERtI4o=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23/go.mod h1:xYWD6BS9ywC5bS3sz9Xh04whO/hzK2plt2Zkyrp4JuA=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.20 h1:tN6W/hg+pkM+tf9XDkWUbDEjGLb+raoBMFsTodcoYKw=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 h1:bpd8vxhlQi2r1hiueOw02f/duEPTMK59Q4QMAoTTtTo=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.20/go.mod h1:YJ898MhD067hSHA6xYCx5ts/jEd8BSOLtQDL3iZsvbc=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23/go.mod h1:15DfR2nw+CRHIk0tqNyifu3G1YdAOy68RftkhMDDwYk=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 h1:qYQ4pzQ2Oz6WpQ8T3HvGHnZydA72MnLuFK9tJwmrbHw=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24 h1:OQqn11BtaYv1WLUowvcA30MpzIu8Ti4pcLPIIyoKZrA=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6/go.mod h1:O3h0IK87yXci+kg6flUKzJnWeziQUKciKrLjcatSNcY=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24/go.mod h1:X5ZJyfwVrWA96GzPmUCWFQaEARPR7gCrpq2E92PJwAE=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 h1:5EniKhLZe4xzL7a+fU3C2tfUN4nWIqlLesfrjkuPFTY=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9 h1:FLudkZLt5ci0ozzgkVo8BJGwvqNaZbTWb3UcucAateA=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7/go.mod h1:x0nZssQ3qZSnIcePWLvcoFisRXJzcTVvYpAAdYX8+GI=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9/go.mod h1:w7wZ/s9qK7c8g4al+UyoF1Sp/Z45UwMGcqIzLWVQHWk=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.20 h1:2HvVAIq+YqgGotK6EkMf+KIEqTISmTYh5zLpYyeTo1Y=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23 h1:pbrxO/kuIwgEsOPLkaHu0O+m4fNgLU8B3vxQ+72jTPw=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.20/go.mod h1:V4X406Y666khGa8ghKmphma/7C0DAtEQYhkq9z4vpbk=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23/go.mod h1:/CMNUqoj46HpS3MNRDEDIwcgEnrtZlKRaHNaHxIFpNA=
 github.com/aws/aws-sdk-go-v2/service/kms v1.49.1 h1:U0asSZ3ifpuIehDPkRI2rxHbmFUMplDA2VeR9Uogrmw=
 github.com/aws/aws-sdk-go-v2/service/kms v1.49.1/go.mod h1:NZo9WJqQ0sxQ1Yqu1IwCHQFQunTms2MlVgejg16S1rY=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 h1:0GFOLzEbOyZABS3PhYfBIx2rNBACYcKty+XGkTgw1ow=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.11 h1:TdJ+HdzOBhU8+iVAOGUTU63VXopcumCOF1paFulHWZc=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.8/go.mod h1:LXypKvk85AROkKhOG6/YEcHFPoX+prKTowKnVdcaIxE=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.11/go.mod h1:R82ZRExE/nheo0N+T8zHPcLRTcH8MGsnR3BiVGX0TwI=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 h1:kiIDLZ005EcKomYYITtfsjn7dtOwHDOFy7IbPXKek2o=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.17 h1:7byT8HUWrgoRp6sXjxtZwgOKfhss5fW6SkLBtqzgRoE=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.13/go.mod h1:2h/xGEowcW/g38g06g3KpRWDlT+OTfxxI0o1KqayAB8=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.17/go.mod h1:xNWknVi4Ezm1vg1QsB/5EWpAJURq22uqd38U8qKvOJc=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 h1:jzKAXIlhZhJbnYwHbvUQZEB8KfgAEuG0dc08Bkda7NU=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.21 h1:+1Kl1zx6bWi4X7cKi3VYh29h8BvsCoHQEQ6ST9X8w7w=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17/go.mod h1:Al9fFsXjv4KfbzQHGe6V4NZSZQXecFcvaIF4e70FoRA=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.21/go.mod h1:4vIRDq+CJB2xFAXZ+YgGUTiEft7oAQlhIs71xcSeuVg=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 h1:Cng+OOwCHmFljXIxpEVXAGMnBia8MSU6Ch5i9PgBkcU=
+github.com/aws/aws-sdk-go-v2/service/sts v1.42.1 h1:F/M5Y9I3nwr2IEpshZgh1GeHpOItExNM9L1euNuh/fk=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.9/go.mod h1:LrlIndBDdjA/EeXeyNBle+gyCwTlizzW5ycgWnvIxkk=
+github.com/aws/aws-sdk-go-v2/service/sts v1.42.1/go.mod h1:mTNxImtovCOEEuD65mKW7DCsL+2gjEH+RPEAexAzAio=
-github.com/aws/smithy-go v1.24.2 h1:FzA3bu/nt/vDvmnkg+R8Xl46gmzEDam6mZ1hzmwXFng=
+github.com/aws/smithy-go v1.25.1 h1:J8ERsGSU7d+aCmdQur5Txg6bVoYelvQJgtZehD12GkI=
-github.com/aws/smithy-go v1.24.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/aws/smithy-go v1.25.1/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ=
@@ -120,8 +120,8 @@ github.com/containerd/console v1.0.5 h1:R0ymNeydRqH2DmakFNdmjR2k0t7UPuiOV/N/27/q
 github.com/containerd/console v1.0.5/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
 github.com/containerd/containerd/api v1.10.0 h1:5n0oHYVBwN4VhoX9fFykCV9dF1/BvAXeg2F8W6UYq1o=
 github.com/containerd/containerd/api v1.10.0/go.mod h1:NBm1OAk8ZL+LG8R0ceObGxT5hbUYj7CzTmR3xh0DlMM=
-github.com/containerd/containerd/v2 v2.2.2 h1:mjVQdtfryzT7lOqs5EYUFZm8ioPVjOpkSoG1GJPxEMY=
+github.com/containerd/containerd/v2 v2.2.3 h1:mOBRLaHGvmgy0bRo1Sg6OD8ugMKZIvCoWWMeMMygliA=
-github.com/containerd/containerd/v2 v2.2.2/go.mod h1:5Jhevmv6/2J+Iu/A2xXAdUIdI5Ah/hfyO7okJ4AFIdY=
+github.com/containerd/containerd/v2 v2.2.3/go.mod h1:ns24cwt+p36mRnuKE3hLRxVBpuSP+a/Y25AMki1t/RY=
 github.com/containerd/continuity v0.4.5 h1:ZRoN1sXq9u7V6QoHMcVWGhOwDFqZ4B9i5H6un1Wh0x4=
 github.com/containerd/continuity v0.4.5/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
@@ -179,8 +179,8 @@ github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5Qvfr
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
 github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/docker/cli v29.4.1+incompatible h1:02RT8QqqwtGRn+6SYypv8IUEbD/ltY6sfKCJIoUcGzk=
+github.com/docker/cli v29.4.2+incompatible h1:nhxMY4v7wB0QMMc5ppeqV6FBMwzqv0n4t2gogu/R2DQ=
-github.com/docker/cli v29.4.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v29.4.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/cli-docs-tool v0.11.0 h1:7d8QARFb7QEobizqxmEM7fOteZEHwH/zWgHQtHZEcfE=
 github.com/docker/cli-docs-tool v0.11.0/go.mod h1:ma8BKiisUo8D6W05XEYIh3oa1UbgrZhi1nowyKFJa8Q=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
@@ -214,8 +214,8 @@ github.com/go-chi/chi/v5 v5.2.4 h1:WtFKPHwlywe8Srng8j2BhOD9312j9cGUxG1SP4V2cR4=
 github.com/go-chi/chi/v5 v5.2.4/go.mod h1:X7Gx4mteadT3eDOMTsXzmI4/rwUpOwBHLpAfupzFJP0=
 github.com/go-ini/ini v1.67.0 h1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A=
 github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
-github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs=
+github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
-github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -358,8 +358,8 @@ github.com/howeyc/gopass v0.0.0-20210920133722-c8aef6fb66ef h1:A9HsByNhogrvm9cWb
 github.com/howeyc/gopass v0.0.0-20210920133722-c8aef6fb66ef/go.mod h1:lADxMC39cJJqL93Duh1xhAs4I2Zs8mKS89XWXFGp9cs=
 github.com/in-toto/attestation v1.1.2 h1:MBFn6lsMq6dptQZJBhalXTcWMb/aJy3V+GX3VYj/V1E=
 github.com/in-toto/attestation v1.1.2/go.mod h1:gYFddHMZj3DiQ0b62ltNi1Vj5rC879bTmBbrv9CRHpM=
-github.com/in-toto/in-toto-golang v0.10.0 h1:+s2eZQSK3WmWfYV85qXVSBfqgawi/5L02MaqA4o/tpM=
+github.com/in-toto/in-toto-golang v0.11.0 h1:nfidMYBFx+E0lnmX5KUnN2Pdm8zdNKal1ayjJuzzRoA=
-github.com/in-toto/in-toto-golang v0.10.0/go.mod h1:wjT4RiyFlLWCmLUJjwB8oZcjaq7HA390aMJcD3xXgmg=
+github.com/in-toto/in-toto-golang v0.11.0/go.mod h1:u3PjTnwFKjp5a1YCcw8SJg0G+tMeKfVoWsWeFMDCMtw=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
@@ -380,8 +380,8 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
+github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao=
-github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -420,8 +420,8 @@ github.com/mitchellh/hashstructure/v2 v2.0.2 h1:vGKWl0YJqUNxE8d+h8f6NJLcCJrgbhC4
 github.com/mitchellh/hashstructure/v2 v2.0.2/go.mod h1:MG3aRVU/N29oo/V/IhBX8GR/zz4kQkprJgF2EVszyDE=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/moby/buildkit v0.29.1-0.20260408185135-a243ce438aee h1:hA4wfynYJPaSnE4r1Ak5t/9goiG+OBKdQT29ZNxONrc=
+github.com/moby/buildkit v0.30.0-rc1 h1:meXm1eqqweZ7EPnTbRiU8c4BjgjDKs7rUczHUsU0nJo=
-github.com/moby/buildkit v0.29.1-0.20260408185135-a243ce438aee/go.mod h1:afndr4EIChUihZio6mhkfTePNtO6KOJh4qW7zOXHhW0=
+github.com/moby/buildkit v0.30.0-rc1/go.mod h1:4ha5jioeEAREXOpmpEUSQ4bKZON1yEc/co9I57+zCZs=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/go-archive v0.2.0 h1:zg5QDUM2mi0JIM9fdQZWC7U8+2ZfixfTYoHL7rWUcP8=
@@ -621,36 +621,36 @@ go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 h1:yI1/OhfEPy7J9eoa6Sj051C7n5dvpj0QX8g4sRchg04=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 h1:0Qx7VGBacMm9ZENQ7TnNObTYI4ShC+lHI16seduaxZo=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0/go.mod h1:NoUCKYWK+3ecatC4HjkRktREheMeEtrXoQxrqYFeHSc=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0/go.mod h1:Sje3i3MjSPKTSPvVWCaL8ugBzJwik3u4smCjUeuupqg=
-go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.67.0 h1:c9r/G1CSw4dPI1jaNNG9RnQP+q4SvZnHciDQJVIvchU=
+go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.68.0 h1:cuXaPAfIoJKsYjBjPSb2nKZEmgM43zVr25l37IxhKME=
-go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.67.0/go.mod h1:gO9smoZe9KnZcJCqcB0lMmQ4Z5VEifYmjMTpnwtTSuQ=
+go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.68.0/go.mod h1:BuzhPofpCzlDi/Q/Xjg54M4/3oWqqyDe2Zeq7A2I0QE=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 h1:CqXxU8VOmDefoh0+ztfGaymYbhdB/tT3zs79QaZTNGY=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0/go.mod h1:BuhAPThV8PBHBvg8ZzZ/Ok3idOdhWIodywz2xEcRbJo=
-go.opentelemetry.io/otel v1.42.0 h1:lSQGzTgVR3+sgJDAU/7/ZMjN9Z+vUip7leaqBKy4sho=
+go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
-go.opentelemetry.io/otel v1.42.0/go.mod h1:lJNsdRMxCUIWuMlVJWzecSMuNjE7dOYyWlqOXWkdqCc=
+go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0 h1:MdKucPl/HbzckWWEisiNqMPhRrAOQX8r4jTuGr636gk=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0 h1:8UQVDcZxOJLtX6gxtDt3vY2WTgvZqMQRzjsqiIHQdkc=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0/go.mod h1:RolT8tWtfHcjajEH5wFIZ4Dgh5jpPdFXYV9pTAk/qjc=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0/go.mod h1:2lmweYCiHYpEjQ/lSJBYhj9jP1zvCvQW4BqL9dnT7FQ=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.42.0 h1:H7O6RlGOMTizyl3R08Kn5pdM06bnH8oscSj7o11tmLA=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 h1:w1K+pCJoPpQifuVpsKamUdn9U0zM3xUziVOqsGksUrY=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.42.0/go.mod h1:mBFWu/WOVDkWWsR7Tx7h6EpQB8wsv7P0Yrh0Pb7othc=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0/go.mod h1:HBy4BjzgVE8139ieRI75oXm3EcDN+6GhD88JT1Kjvxg=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 h1:THuZiwpQZuHPul65w4WcwEnkX2QIuMT+UFoOrygtoJw=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0/go.mod h1:J2pvYM5NGHofZ2/Ru6zw/TNWnEQp5crgyDeSrYpXkAw=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 h1:zWWrB1U6nqhS/k6zYB74CjRpuiitRtLLi68VcgmOEto=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 h1:RAE+JPfvEmvy+0LzyUA25/SGawPwIUbZ6u0Wug54sLc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0/go.mod h1:2qXPNBX1OVRC0IwOnfo1ljoid+RD0QK3443EaqVlsOU=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0/go.mod h1:AGmbycVGEsRx9mXMZ75CsOyhSP6MFIcj/6dnG+vhVjk=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.42.0 h1:uLXP+3mghfMf7XmV4PkGfFhFKuNWoCvvx5wP/wOXo0o=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 h1:3iZJKlCZufyRzPzlQhUIWVmfltrXuGyfjREgGP3UUjc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.42.0/go.mod h1:v0Tj04armyT59mnURNUJf7RCKcKzq+lgJs6QSjHjaTc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0/go.mod h1:/G+nUPfhq2e+qiXMGxMwumDrP5jtzU+mWN7/sjT2rak=
 go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.42.0 h1:s/1iRkCKDfhlh1JF26knRneorus8aOwVIDhvYx9WoDw=
 go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.42.0/go.mod h1:UI3wi0FXg1Pofb8ZBiBLhtMzgoTm1TYkMvn71fAqDzs=
-go.opentelemetry.io/otel/metric v1.42.0 h1:2jXG+3oZLNXEPfNmnpxKDeZsFI5o4J+nz6xUlaFdF/4=
+go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
-go.opentelemetry.io/otel/metric v1.42.0/go.mod h1:RlUN/7vTU7Ao/diDkEpQpnz3/92J9ko05BIwxYa2SSI=
+go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
-go.opentelemetry.io/otel/sdk v1.42.0 h1:LyC8+jqk6UJwdrI/8VydAq/hvkFKNHZVIWuslJXYsDo=
+go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
-go.opentelemetry.io/otel/sdk v1.42.0/go.mod h1:rGHCAxd9DAph0joO4W6OPwxjNTYWghRWmkHuGbayMts=
+go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
-go.opentelemetry.io/otel/sdk/metric v1.42.0 h1:D/1QR46Clz6ajyZ3G8SgNlTJKBdGp84q9RKCAZ3YGuA=
+go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
-go.opentelemetry.io/otel/sdk/metric v1.42.0/go.mod h1:Ua6AAlDKdZ7tdvaQKfSmnFTdHx37+J4ba8MwVCYM5hc=
+go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
-go.opentelemetry.io/otel/trace v1.42.0 h1:OUCgIPt+mzOnaUTpOQcBiM/PLQ/Op7oq6g4LenLmOYY=
+go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
-go.opentelemetry.io/otel/trace v1.42.0/go.mod h1:f3K9S+IFqnumBkKhRJMeaZeNk9epyhnCmQh/EysQCdc=
+go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
-go.opentelemetry.io/proto/otlp v1.9.0 h1:l706jCMITVouPOqEnii2fIAuO3IVGBRPV5ICjceRb/A=
+go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g=
-go.opentelemetry.io/proto/otlp v1.9.0/go.mod h1:xE+Cx5E/eEHw+ISFkwPLwCZefwVjY+pqKg1qcK03+/4=
+go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
 go.step.sm/crypto v0.74.0 h1:/APBEv45yYR4qQFg47HA8w1nesIGcxh44pGyQNw6JRA=
 go.step.sm/crypto v0.74.0/go.mod h1:UoXqCAJjjRgzPte0Llaqen7O9P7XjPmgjgTHQGkKCDk=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
@@ -714,18 +714,18 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
+gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
-gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
+gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
 google.golang.org/api v0.260.0 h1:XbNi5E6bOVEj/uLXQRlt6TKuEzMD7zvW/6tNwltE4P4=
 google.golang.org/api v0.260.0/go.mod h1:Shj1j0Phr/9sloYrKomICzdYgsSDImpTxME8rGLaZ/o=
 google.golang.org/genproto v0.0.0-20251202230838-ff82c1b0f217 h1:GvESR9BIyHUahIb0NcTum6itIWtdoglGX+rnGxm2934=
 google.golang.org/genproto v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:yJ2HH4EHEDTd3JiLmhds6NkJ17ITVYOdV3m3VKOnws0=
-google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57 h1:JLQynH/LBHfCTSbDWl+py8C+Rg/k1OVH3xfcaiANuF0=
+google.golang.org/genproto/googleapis/api v0.0.0-20260406210006-6f92a3bedf2d h1:/aDRtSZJjyLQzm75d+a1wOJaqyKBMvIAfeQmoa3ORiI=
-google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57/go.mod h1:kSJwQxqmFXeo79zOmbrALdflXQeAYcUbgS7PbpMknCY=
+google.golang.org/genproto/googleapis/api v0.0.0-20260406210006-6f92a3bedf2d/go.mod h1:etfGUgejTiadZAUaEP14NP97xi1RGeawqkjDARA/UOs=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 h1:ggcbiqK8WWh6l1dnltU4BgWGIGo+EVYxCaAPih/zQXQ=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d h1:wT2n40TBqFY6wiwazVK9/iTWbsQrgk5ZfCSVFLO9LQA=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=
+google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
-google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
+google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 h1:F29+wU6Ee6qgu9TddPgooOdaqsxTMunOoj8KA5yuS5A=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1/go.mod h1:5KF+wpkbTSbGcR9zteSqZV6fqFOWBl4Yde8En8MryZA=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
@@ -84,7 +84,7 @@ func BuildName(fattrs map[string]string, ls *localstate.State) string {
 		}
 	}
 	if res == "" && vcsSource != "" {
-		u, _ := dfgitutil.FragmentFormat(vcsSource)
+		u, _ := dfgitutil.FragmentFormat(vcsSource, false)
 		return u
 	}
 	return res
@@ -275,7 +275,7 @@ func (sc *spanContext) asTraceSpanContext() (trace.SpanContext, error) {
 func (kv *keyValue) asAttributeKeyValue() (attribute.KeyValue, error) {
 	// value types get encoded as string
 	switch kv.Value.Type {
-	case attribute.INVALID.String():
+	case attribute.EMPTY.String():
 		return attribute.KeyValue{}, errors.New("invalid value type")
 	case attribute.BOOL.String():
 		return attribute.Bool(kv.Key, kv.Value.Value.(bool)), nil
@@ -3,4 +3,4 @@
 package aws
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.41.4"
+const goModuleVersion = "1.41.7"
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"strconv"
 	"strings"
 	"sync/atomic"
 	"time"
 	internalcontext "github.com/aws/aws-sdk-go-v2/internal/context"
@@ -43,6 +44,10 @@ type Attempt struct {
 	// A Meter instance for recording retry-related metrics.
 	OperationMeter metrics.Meter
 	// Initial clock skew that would have been saved from a previous operation
 	// call.
 	ClientSkew *atomic.Int64
 	retryer       aws.RetryerV2
 	requestCloner RequestCloner
 }
@@ -82,8 +87,12 @@ func (r Attempt) logf(logger logging.Logger, classification logging.Classificati
 func (r *Attempt) HandleFinalize(ctx context.Context, in smithymiddle.FinalizeInput, next smithymiddle.FinalizeHandler) (
 	out smithymiddle.FinalizeOutput, metadata smithymiddle.Metadata, err error,
 ) {
 	var attemptNum int
 	var attemptClockSkew time.Duration
 	if r.ClientSkew != nil {
 		attemptClockSkew = time.Duration(r.ClientSkew.Load())
 	}
 	var attemptNum int
 	var attemptResults AttemptResults
 	maxAttempts := r.retryer.MaxAttempts()
@@ -99,6 +108,8 @@ func (r *Attempt) HandleFinalize(ctx context.Context, in smithymiddle.FinalizeIn
 		attemptInput := in
 		attemptInput.Request = r.requestCloner(attemptInput.Request)
 		ctx = internalcontext.SetAttemptSkewContext(ctx, attemptClockSkew)
 		// Record the metadata for the for attempt being started.
 		attemptCtx := setRetryMetadata(ctx, retryMetadata{
 			AttemptNum:       attemptNum,
@@ -107,9 +118,6 @@ func (r *Attempt) HandleFinalize(ctx context.Context, in smithymiddle.FinalizeIn
 			AttemptClockSkew: attemptClockSkew,
 		})
 		// Setting clock skew to be used on other context (like signing)
 		ctx = internalcontext.SetAttemptSkewContext(ctx, attemptClockSkew)
 		var attemptResult AttemptResult
 		attemptCtx, span := tracing.StartSpan(attemptCtx, "Attempt", func(o *tracing.SpanOptions) {
@@ -149,6 +157,14 @@ func (r *Attempt) HandleFinalize(ctx context.Context, in smithymiddle.FinalizeIn
 		}
 	}
 	// this guarantees we are staying on top of the persistent skew value
 	// (either to apply it or to heal it back if the clocks realign)
 	if r.ClientSkew != nil {
 		if resultSkew, ok := awsmiddle.GetAttemptSkew(metadata); ok {
 			r.ClientSkew.Store(resultSkew.Nanoseconds())
 		}
 	}
 	addAttemptResults(&metadata, attemptResults)
 	return out, metadata, err
 }
@@ -1,3 +1,25 @@
 # v1.32.17 (2026-04-29)
 * **Dependency Update**: Update to smithy-go v1.25.1.
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.32.16 (2026-04-17)
 * **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.32.15 (2026-04-16)
 * No change notes available for this release.
 # v1.32.14 (2026-04-02)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.32.13 (2026-03-26)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.32.12 (2026-03-13)
 * **Bug Fix**: Replace usages of the old ioutil/ package throughout the SDK.
@@ -3,4 +3,4 @@
 package config
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.32.12"
+const goModuleVersion = "1.32.17"
@@ -12,8 +12,8 @@ import (
 	"time"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/config/internal/ini"
 	"github.com/aws/aws-sdk-go-v2/feature/ec2/imds"
 	"github.com/aws/aws-sdk-go-v2/internal/ini"
 	"github.com/aws/aws-sdk-go-v2/internal/shareddefaults"
 	"github.com/aws/smithy-go/logging"
 	smithyrequestcompression "github.com/aws/smithy-go/private/requestcompression"
@@ -1,3 +1,21 @@
 # v1.19.16 (2026-04-29)
 * **Dependency Update**: Update to smithy-go v1.25.1.
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.19.15 (2026-04-17)
 * **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.19.14 (2026-04-02)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.19.13 (2026-03-26)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.19.12 (2026-03-13)
 * **Bug Fix**: Replace usages of the old ioutil/ package throughout the SDK.
@@ -3,4 +3,4 @@
 package credentials
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.19.12"
+const goModuleVersion = "1.19.16"
@@ -1,3 +1,17 @@
 # v1.18.23 (2026-04-29)
 * **Dependency Update**: Update to smithy-go v1.25.1.
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.18.22 (2026-04-17)
 * **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.18.21 (2026-03-26)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.18.20 (2026-03-13)
 * **Bug Fix**: Replace usages of the old ioutil/ package throughout the SDK.
@@ -3,4 +3,4 @@
 package imds
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.18.20"
+const goModuleVersion = "1.18.23"
@@ -1,3 +1,17 @@
 # v1.4.23 (2026-04-29)
 * **Dependency Update**: Update to smithy-go v1.25.1.
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.4.22 (2026-04-17)
 * **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.4.21 (2026-03-26)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.4.20 (2026-03-13)
 * **Dependency Update**: Updated to the latest SDK module versions
@@ -3,4 +3,4 @@
 package configsources
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.4.20"
+const goModuleVersion = "1.4.23"
@@ -1,3 +1,17 @@
 # v2.7.23 (2026-04-29)
 * **Dependency Update**: Update to smithy-go v1.25.1.
 * **Dependency Update**: Updated to the latest SDK module versions
 # v2.7.22 (2026-04-17)
 * **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
 * **Dependency Update**: Updated to the latest SDK module versions
 # v2.7.21 (2026-03-26)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v2.7.20 (2026-03-13)
 * **Dependency Update**: Updated to the latest SDK module versions
@@ -3,4 +3,4 @@
 package endpoints
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "2.7.20"
+const goModuleVersion = "2.7.23"
@@ -1,296 +0,0 @@
 # v1.8.6 (2026-03-13)
 * **Bug Fix**: Replace usages of the old ioutil/ package throughout the SDK.
 # v1.8.5 (2026-03-03)
 * **Bug Fix**: Modernize non codegen files with go fix
 * **Dependency Update**: Bump minimum Go version to 1.24
 # v1.8.4 (2025-10-16)
 * **Dependency Update**: Bump minimum Go version to 1.23.
 # v1.8.3 (2025-02-18)
 * **Bug Fix**: Bump go version to 1.22
 # v1.8.2 (2025-01-24)
 * **Bug Fix**: Refactor filepath.Walk to filepath.WalkDir
 # v1.8.1 (2024-08-15)
 * **Dependency Update**: Bump minimum Go version to 1.21.
 # v1.8.0 (2024-02-13)
 * **Feature**: Bump minimum Go version to 1.20 per our language support policy.
 # v1.7.3 (2024-01-22)
 * **Bug Fix**: Remove invalid escaping of shared config values. All values in the shared config file will now be interpreted literally, save for fully-quoted strings which are unwrapped for legacy reasons.
 # v1.7.2 (2023-12-08)
 * **Bug Fix**: Correct loading of [services *] sections into shared config.
 # v1.7.1 (2023-11-16)
 * **Bug Fix**: Fix recognition of trailing comments in shared config properties. # or ; separators that aren't preceded by whitespace at the end of a property value should be considered part of it.
 # v1.7.0 (2023-11-13)
 * **Feature**: Replace the legacy config parser with a modern, less-strict implementation. Parsing failures within a section will now simply ignore the invalid line rather than silently drop the entire section.
 # v1.6.0 (2023-11-09.2)
 * **Feature**: BREAKFIX: In order to support subproperty parsing, invalid property definitions must not be ignored
 # v1.5.2 (2023-11-09)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.5.1 (2023-11-07)
 * **Bug Fix**: Fix subproperty performance regression
 # v1.5.0 (2023-11-01)
 * **Feature**: Adds support for configured endpoints via environment variables and the AWS shared configuration file.
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.4.0 (2023-10-31)
 * **Feature**: **BREAKING CHANGE**: Bump minimum go version to 1.19 per the revised [go version support policy](https://aws.amazon.com/blogs/developer/aws-sdk-for-go-aligns-with-go-release-policy-on-supported-runtimes/).
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.45 (2023-10-12)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.44 (2023-10-06)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.43 (2023-09-22)
 * **Bug Fix**: Fixed a bug where merging `max_attempts` or `duration_seconds` fields across shared config files with invalid values would silently default them to 0.
 * **Bug Fix**: Move type assertion of config values out of the parsing stage, which resolves an issue where the contents of a profile would silently be dropped with certain numeric formats.
 # v1.3.42 (2023-08-21)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.41 (2023-08-18)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.40 (2023-08-17)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.39 (2023-08-07)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.38 (2023-07-31)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.37 (2023-07-28)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.36 (2023-07-13)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.35 (2023-06-13)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.34 (2023-04-24)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.33 (2023-04-07)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.32 (2023-03-21)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.31 (2023-03-10)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.30 (2023-02-20)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.29 (2023-02-03)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.28 (2022-12-15)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.27 (2022-12-02)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.26 (2022-10-24)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.25 (2022-10-21)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.24 (2022-09-20)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.23 (2022-09-14)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.22 (2022-09-02)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.21 (2022-08-31)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.20 (2022-08-29)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.19 (2022-08-11)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.18 (2022-08-09)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.17 (2022-08-08)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.16 (2022-08-01)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.15 (2022-07-05)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.14 (2022-06-29)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.13 (2022-06-07)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.12 (2022-05-17)
 * **Bug Fix**: Removes the fuzz testing files from the module, as they are invalid and not used.
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.11 (2022-04-25)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.10 (2022-03-30)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.9 (2022-03-24)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.8 (2022-03-23)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.7 (2022-03-08)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.6 (2022-02-24)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.5 (2022-01-28)
 * **Bug Fix**: Fixes the SDK's handling of `duration_sections` in the shared credentials file or specified in multiple shared config and shared credentials files under the same profile. [#1568](https://github.com/aws/aws-sdk-go-v2/pull/1568). Thanks to [Amir Szekely](https://github.com/kichik) for help reproduce this bug.
 # v1.3.4 (2022-01-14)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.3 (2022-01-07)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.2 (2021-12-02)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.1 (2021-11-19)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.0 (2021-11-06)
 * **Feature**: The SDK now supports configuration of FIPS and DualStack endpoints using environment variables, shared configuration, or programmatically.
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.2.5 (2021-10-21)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.2.4 (2021-10-11)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.2.3 (2021-09-17)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.2.2 (2021-08-27)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.2.1 (2021-08-19)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.2.0 (2021-08-04)
 * **Feature**: adds error handling for defered close calls
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.1.1 (2021-07-15)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.1.0 (2021-07-01)
 * **Feature**: Support for `:`, `=`, `[`, `]` being present in expression values.
 # v1.0.1 (2021-06-25)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.0 (2021-05-20)
 * **Release**: The `github.com/aws/aws-sdk-go-v2/internal/ini` package is now a Go Module.
 * **Dependency Update**: Updated to the latest SDK module versions
@@ -1,42 +0,0 @@
 package middleware
 import (
 	"context"
 	"sync/atomic"
 	"time"
 	internalcontext "github.com/aws/aws-sdk-go-v2/internal/context"
 	"github.com/aws/smithy-go/middleware"
 )
 // AddTimeOffsetMiddleware sets a value representing clock skew on the request context.
 // This can be read by other operations (such as signing) to correct the date value they send
 // on the request
 type AddTimeOffsetMiddleware struct {
 	Offset *atomic.Int64
 }
 // ID the identifier for AddTimeOffsetMiddleware
 func (m *AddTimeOffsetMiddleware) ID() string { return "AddTimeOffsetMiddleware" }
 // HandleBuild sets a value for attemptSkew on the request context if one is set on the client.
 func (m AddTimeOffsetMiddleware) HandleBuild(ctx context.Context, in middleware.BuildInput, next middleware.BuildHandler) (
 	out middleware.BuildOutput, metadata middleware.Metadata, err error,
 ) {
 	if m.Offset != nil {
 		offset := time.Duration(m.Offset.Load())
 		ctx = internalcontext.SetAttemptSkewContext(ctx, offset)
 	}
 	return next.HandleBuild(ctx, in)
 }
 // HandleDeserialize gets the clock skew context from the context, and if set, sets it on the pointer
 // held by AddTimeOffsetMiddleware
 func (m *AddTimeOffsetMiddleware) HandleDeserialize(ctx context.Context, in middleware.DeserializeInput, next middleware.DeserializeHandler) (
 	out middleware.DeserializeOutput, metadata middleware.Metadata, err error,
 ) {
 	if v := internalcontext.GetAttemptSkewContext(ctx); v != 0 {
 		m.Offset.Store(v.Nanoseconds())
 	}
 	return next.HandleDeserialize(ctx, in)
 }
@@ -0,0 +1,460 @@
 # v1.4.24 (2026-04-29)
 * **Dependency Update**: Update to smithy-go v1.25.1.
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.4.23 (2026-04-17)
 * **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.4.22 (2026-03-26)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.4.21 (2026-03-13)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.4.20 (2026-03-05)
 * **Bug Fix**: Read the correct auth property for SigV4A signing names.
 # v1.4.19 (2026-03-03)
 * **Bug Fix**: Modernize non codegen files with go fix
 * **Dependency Update**: Bump minimum Go version to 1.24
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.4.18 (2026-02-23)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.4.17 (2026-01-09)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.4.16 (2025-12-08)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.4.15 (2025-12-02)
 * **Dependency Update**: Updated to the latest SDK module versions
 * **Dependency Update**: Upgrade to smithy-go v1.24.0. Notably this version of the library reduces the allocation footprint of the middleware system. We observe a ~10% reduction in allocations per SDK call with this change.
 # v1.4.14 (2025-11-19.2)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.4.13 (2025-11-04)
 * **Dependency Update**: Updated to the latest SDK module versions
 * **Dependency Update**: Upgrade to smithy-go v1.23.2 which should convey some passive reduction of overall allocations, especially when not using the metrics system.
 # v1.4.12 (2025-10-30)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.4.11 (2025-10-23)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.4.10 (2025-10-16)
 * **Dependency Update**: Bump minimum Go version to 1.23.
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.4.9 (2025-09-26)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.4.8 (2025-09-23)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.4.7 (2025-09-08)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.4.6 (2025-08-29)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.4.5 (2025-08-27)
 * **Dependency Update**: Update to smithy-go v1.23.0.
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.4.4 (2025-08-21)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.4.3 (2025-08-11)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.4.2 (2025-08-04)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.4.1 (2025-07-30)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.4.0 (2025-07-28)
 * **Feature**: Add support for HTTP interceptors.
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.37 (2025-07-19)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.36 (2025-06-17)
 * **Dependency Update**: Update to smithy-go v1.22.4.
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.35 (2025-06-10)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.34 (2025-02-27)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.33 (2025-02-18)
 * **Bug Fix**: Bump go version to 1.22
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.32 (2025-02-05)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.31 (2025-01-31)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.30 (2025-01-30)
 * **Bug Fix**: Do not sign Transfer-Encoding header in Sigv4[a]. Fixes a signer mismatch issue with S3 Accelerate.
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.29 (2025-01-24)
 * **Dependency Update**: Updated to the latest SDK module versions
 * **Dependency Update**: Upgrade to smithy-go v1.22.2.
 # v1.3.28 (2025-01-15)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.27 (2025-01-09)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.26 (2024-12-19)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.25 (2024-12-02)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.24 (2024-11-18)
 * **Dependency Update**: Update to smithy-go v1.22.1.
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.23 (2024-11-06)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.22 (2024-10-28)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.21 (2024-10-08)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.20 (2024-10-07)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.19 (2024-10-04)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.18 (2024-09-20)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.17 (2024-09-03)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.16 (2024-08-15)
 * **Dependency Update**: Bump minimum Go version to 1.21.
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.15 (2024-07-10.2)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.14 (2024-07-10)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.13 (2024-06-28)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.12 (2024-06-19)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.11 (2024-06-18)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.10 (2024-06-17)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.9 (2024-06-07)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.8 (2024-06-03)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.7 (2024-05-16)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.6 (2024-05-15)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.5 (2024-03-29)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.4 (2024-03-18)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.3 (2024-03-07)
 * **Bug Fix**: Remove dependency on go-cmp.
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.2 (2024-02-23)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.1 (2024-02-21)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.3.0 (2024-02-13)
 * **Feature**: Bump minimum Go version to 1.20 per our language support policy.
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.2.10 (2024-01-04)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.2.9 (2023-12-07)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.2.8 (2023-12-01)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.2.7 (2023-11-30)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.2.6 (2023-11-29)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.2.5 (2023-11-28.2)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.2.4 (2023-11-20)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.2.3 (2023-11-15)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.2.2 (2023-11-09)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.2.1 (2023-11-01)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.2.0 (2023-10-31)
 * **Feature**: **BREAKING CHANGE**: Bump minimum go version to 1.19 per the revised [go version support policy](https://aws.amazon.com/blogs/developer/aws-sdk-for-go-aligns-with-go-release-policy-on-supported-runtimes/).
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.1.6 (2023-10-12)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.1.5 (2023-10-06)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.1.4 (2023-08-21)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.1.3 (2023-08-18)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.1.2 (2023-08-17)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.1.1 (2023-08-07)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.1.0 (2023-07-31)
 * **Feature**: Adds support for smithy-modeled endpoint resolution. A new rules-based endpoint resolution will be added to the SDK which will supercede and deprecate existing endpoint resolution. Specifically, EndpointResolver will be deprecated while BaseEndpoint and EndpointResolverV2 will take its place. For more information, please see the Endpoints section in our Developer Guide.
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.28 (2023-07-28)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.27 (2023-07-13)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.26 (2023-06-13)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.25 (2023-04-24)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.24 (2023-04-07)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.23 (2023-03-21)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.22 (2023-03-10)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.21 (2023-02-20)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.20 (2023-02-14)
 * No change notes available for this release.
 # v1.0.19 (2023-02-03)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.18 (2022-12-15)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.17 (2022-12-02)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.16 (2022-10-24)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.15 (2022-10-21)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.14 (2022-09-20)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.13 (2022-09-14)
 * **Bug Fix**: Fixes an issues where an error from an underlying SigV4 credential provider would not be surfaced from the SigV4a credential provider. Contribution by [sakthipriyan-aqfer](https://github.com/sakthipriyan-aqfer).
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.12 (2022-09-02)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.11 (2022-08-31)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.10 (2022-08-29)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.9 (2022-08-11)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.8 (2022-08-09)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.7 (2022-08-08)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.6 (2022-08-01)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.5 (2022-07-05)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.4 (2022-06-29)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.3 (2022-06-07)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.2 (2022-05-17)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.1 (2022-04-25)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.0 (2022-04-07)
 * **Release**: New internal v4a signing module location.
@@ -0,0 +1,141 @@
 package v4a
 import (
 	"context"
 	"crypto/ecdsa"
 	"fmt"
 	"sync"
 	"sync/atomic"
 	"time"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/internal/sdk"
 )
 // Credentials is Context, ECDSA, and Optional Session Token that can be used
 // to sign requests using SigV4a
 type Credentials struct {
 	Context      string
 	PrivateKey   *ecdsa.PrivateKey
 	SessionToken string
 	// Time the credentials will expire.
 	CanExpire bool
 	Expires   time.Time
 }
 // Expired returns if the credentials have expired.
 func (v Credentials) Expired() bool {
 	if v.CanExpire {
 		return !v.Expires.After(sdk.NowTime())
 	}
 	return false
 }
 // HasKeys returns if the credentials keys are set.
 func (v Credentials) HasKeys() bool {
 	return len(v.Context) > 0 && v.PrivateKey != nil
 }
 // SymmetricCredentialAdaptor wraps a SigV4 AccessKey/SecretKey provider and adapts the credentials
 // to a ECDSA PrivateKey for signing with SiV4a
 type SymmetricCredentialAdaptor struct {
 	SymmetricProvider aws.CredentialsProvider
 	asymmetric atomic.Value
 	m          sync.Mutex
 }
 // Retrieve retrieves symmetric credentials from the underlying provider.
 func (s *SymmetricCredentialAdaptor) Retrieve(ctx context.Context) (aws.Credentials, error) {
 	symCreds, err := s.retrieveFromSymmetricProvider(ctx)
 	if err != nil {
 		return aws.Credentials{}, err
 	}
 	if asymCreds := s.getCreds(); asymCreds == nil {
 		return symCreds, nil
 	}
 	s.m.Lock()
 	defer s.m.Unlock()
 	asymCreds := s.getCreds()
 	if asymCreds == nil {
 		return symCreds, nil
 	}
 	// if the context does not match the access key id clear it
 	if asymCreds.Context != symCreds.AccessKeyID {
 		s.asymmetric.Store((*Credentials)(nil))
 	}
 	return symCreds, nil
 }
 // RetrievePrivateKey returns credentials suitable for SigV4a signing
 func (s *SymmetricCredentialAdaptor) RetrievePrivateKey(ctx context.Context) (Credentials, error) {
 	if asymCreds := s.getCreds(); asymCreds != nil {
 		return *asymCreds, nil
 	}
 	s.m.Lock()
 	defer s.m.Unlock()
 	if asymCreds := s.getCreds(); asymCreds != nil {
 		return *asymCreds, nil
 	}
 	symmetricCreds, err := s.retrieveFromSymmetricProvider(ctx)
 	if err != nil {
 		return Credentials{}, fmt.Errorf("failed to retrieve symmetric credentials: %v", err)
 	}
 	privateKey, err := deriveKeyFromAccessKeyPair(symmetricCreds.AccessKeyID, symmetricCreds.SecretAccessKey)
 	if err != nil {
 		return Credentials{}, fmt.Errorf("failed to derive assymetric key from credentials")
 	}
 	creds := Credentials{
 		Context:      symmetricCreds.AccessKeyID,
 		PrivateKey:   privateKey,
 		SessionToken: symmetricCreds.SessionToken,
 		CanExpire:    symmetricCreds.CanExpire,
 		Expires:      symmetricCreds.Expires,
 	}
 	s.asymmetric.Store(&creds)
 	return creds, nil
 }
 func (s *SymmetricCredentialAdaptor) getCreds() *Credentials {
 	v := s.asymmetric.Load()
 	if v == nil {
 		return nil
 	}
 	c := v.(*Credentials)
 	if c != nil && c.HasKeys() && !c.Expired() {
 		return c
 	}
 	return nil
 }
 func (s *SymmetricCredentialAdaptor) retrieveFromSymmetricProvider(ctx context.Context) (aws.Credentials, error) {
 	credentials, err := s.SymmetricProvider.Retrieve(ctx)
 	if err != nil {
 		return aws.Credentials{}, err
 	}
 	return credentials, nil
 }
 // CredentialsProvider is the interface for a provider to retrieve credentials
 // to sign requests with.
 type CredentialsProvider interface {
 	RetrievePrivateKey(context.Context) (Credentials, error)
 }
@@ -0,0 +1,17 @@
 package v4a
 import "fmt"
 // SigningError indicates an error condition occurred while performing SigV4a signing
 type SigningError struct {
 	Err error
 }
 func (e *SigningError) Error() string {
 	return fmt.Sprintf("failed to sign request: %v", e.Err)
 }
 // Unwrap returns the underlying error cause
 func (e *SigningError) Unwrap() error {
 	return e.Err
 }
@@ -1,6 +1,6 @@
 // Code generated by internal/repotools/cmd/updatemodulemeta DO NOT EDIT.
-package ini
+package v4a
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.8.6"
+const goModuleVersion = "1.4.24"
@@ -0,0 +1,30 @@
 package crypto
 import "fmt"
 // ConstantTimeByteCompare is a constant-time byte comparison of x and y. This function performs an absolute comparison
 // if the two byte slices assuming they represent a big-endian number.
 //
 //		 error if len(x) != len(y)
 //	  -1 if x <  y
 //	   0 if x == y
 //	  +1 if x >  y
 func ConstantTimeByteCompare(x, y []byte) (int, error) {
 	if len(x) != len(y) {
 		return 0, fmt.Errorf("slice lengths do not match")
 	}
 	xLarger, yLarger := 0, 0
 	for i := 0; i < len(x); i++ {
 		xByte, yByte := int(x[i]), int(y[i])
 		x := ((yByte - xByte) >> 8) & 1
 		y := ((xByte - yByte) >> 8) & 1
 		xLarger |= x &^ yLarger
 		yLarger |= y &^ xLarger
 	}
 	return xLarger - yLarger, nil
 }
@@ -0,0 +1,113 @@
 package crypto
 import (
 	"bytes"
 	"crypto/ecdsa"
 	"crypto/elliptic"
 	"crypto/hmac"
 	"encoding/asn1"
 	"encoding/binary"
 	"fmt"
 	"hash"
 	"math"
 	"math/big"
 )
 type ecdsaSignature struct {
 	R, S *big.Int
 }
 // ECDSAKey takes the given elliptic curve, and private key (d) byte slice
 // and returns the private ECDSA key.
 func ECDSAKey(curve elliptic.Curve, d []byte) *ecdsa.PrivateKey {
 	return ECDSAKeyFromPoint(curve, (&big.Int{}).SetBytes(d))
 }
 // ECDSAKeyFromPoint takes the given elliptic curve and point and returns the
 // private and public keypair
 func ECDSAKeyFromPoint(curve elliptic.Curve, d *big.Int) *ecdsa.PrivateKey {
 	pX, pY := curve.ScalarBaseMult(d.Bytes())
 	privKey := &ecdsa.PrivateKey{
 		PublicKey: ecdsa.PublicKey{
 			Curve: curve,
 			X:     pX,
 			Y:     pY,
 		},
 		D: d,
 	}
 	return privKey
 }
 // ECDSAPublicKey takes the provide curve and (x, y) coordinates and returns
 // *ecdsa.PublicKey. Returns an error if the given points are not on the curve.
 func ECDSAPublicKey(curve elliptic.Curve, x, y []byte) (*ecdsa.PublicKey, error) {
 	xPoint := (&big.Int{}).SetBytes(x)
 	yPoint := (&big.Int{}).SetBytes(y)
 	if !curve.IsOnCurve(xPoint, yPoint) {
 		return nil, fmt.Errorf("point(%v, %v) is not on the given curve", xPoint.String(), yPoint.String())
 	}
 	return &ecdsa.PublicKey{
 		Curve: curve,
 		X:     xPoint,
 		Y:     yPoint,
 	}, nil
 }
 // VerifySignature takes the provided public key, hash, and asn1 encoded signature and returns
 // whether the given signature is valid.
 func VerifySignature(key *ecdsa.PublicKey, hash []byte, signature []byte) (bool, error) {
 	var ecdsaSignature ecdsaSignature
 	_, err := asn1.Unmarshal(signature, &ecdsaSignature)
 	if err != nil {
 		return false, err
 	}
 	return ecdsa.Verify(key, hash, ecdsaSignature.R, ecdsaSignature.S), nil
 }
 // HMACKeyDerivation provides an implementation of a NIST-800-108 of a KDF (Key Derivation Function) in Counter Mode.
 // For the purposes of this implantation HMAC is used as the PRF (Pseudorandom function), where the value of
 // `r` is defined as a 4 byte counter.
 func HMACKeyDerivation(hash func() hash.Hash, bitLen int, key []byte, label, context []byte) ([]byte, error) {
 	// verify that we won't overflow the counter
 	n := int64(math.Ceil((float64(bitLen) / 8) / float64(hash().Size())))
 	if n > 0x7FFFFFFF {
 		return nil, fmt.Errorf("unable to derive key of size %d using 32-bit counter", bitLen)
 	}
 	// verify the requested bit length is not larger then the length encoding size
 	if int64(bitLen) > 0x7FFFFFFF {
 		return nil, fmt.Errorf("bitLen is greater than 32-bits")
 	}
 	fixedInput := bytes.NewBuffer(nil)
 	fixedInput.Write(label)
 	fixedInput.WriteByte(0x00)
 	fixedInput.Write(context)
 	if err := binary.Write(fixedInput, binary.BigEndian, int32(bitLen)); err != nil {
 		return nil, fmt.Errorf("failed to write bit length to fixed input string: %v", err)
 	}
 	var output []byte
 	h := hmac.New(hash, key)
 	for i := int64(1); i <= n; i++ {
 		h.Reset()
 		if err := binary.Write(h, binary.BigEndian, int32(i)); err != nil {
 			return nil, err
 		}
 		_, err := h.Write(fixedInput.Bytes())
 		if err != nil {
 			return nil, err
 		}
 		output = append(output, h.Sum(nil)...)
 	}
 	return output[:bitLen/8], nil
 }
@@ -0,0 +1,36 @@
 package v4
 const (
 	// EmptyStringSHA256 is the hex encoded sha256 value of an empty string
 	EmptyStringSHA256 = `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
 	// UnsignedPayload indicates that the request payload body is unsigned
 	UnsignedPayload = "UNSIGNED-PAYLOAD"
 	// AmzAlgorithmKey indicates the signing algorithm
 	AmzAlgorithmKey = "X-Amz-Algorithm"
 	// AmzSecurityTokenKey indicates the security token to be used with temporary credentials
 	AmzSecurityTokenKey = "X-Amz-Security-Token"
 	// AmzDateKey is the UTC timestamp for the request in the format YYYYMMDD'T'HHMMSS'Z'
 	AmzDateKey = "X-Amz-Date"
 	// AmzCredentialKey is the access key ID and credential scope
 	AmzCredentialKey = "X-Amz-Credential"
 	// AmzSignedHeadersKey is the set of headers signed for the request
 	AmzSignedHeadersKey = "X-Amz-SignedHeaders"
 	// AmzSignatureKey is the query parameter to store the SigV4 signature
 	AmzSignatureKey = "X-Amz-Signature"
 	// TimeFormat is the time format to be used in the X-Amz-Date header or query parameter
 	TimeFormat = "20060102T150405Z"
 	// ShortTimeFormat is the shorten time format used in the credential scope
 	ShortTimeFormat = "20060102"
 	// ContentSHAKey is the SHA256 of request body
 	ContentSHAKey = "X-Amz-Content-Sha256"
 )
@@ -0,0 +1,82 @@
 package v4
 import (
 	sdkstrings "github.com/aws/aws-sdk-go-v2/internal/strings"
 )
 // Rules houses a set of Rule needed for validation of a
 // string value
 type Rules []Rule
 // Rule interface allows for more flexible rules and just simply
 // checks whether or not a value adheres to that Rule
 type Rule interface {
 	IsValid(value string) bool
 }
 // IsValid will iterate through all rules and see if any rules
 // apply to the value and supports nested rules
 func (r Rules) IsValid(value string) bool {
 	for _, rule := range r {
 		if rule.IsValid(value) {
 			return true
 		}
 	}
 	return false
 }
 // MapRule generic Rule for maps
 type MapRule map[string]struct{}
 // IsValid for the map Rule satisfies whether it exists in the map
 func (m MapRule) IsValid(value string) bool {
 	_, ok := m[value]
 	return ok
 }
 // AllowList is a generic Rule for whitelisting
 type AllowList struct {
 	Rule
 }
 // IsValid for AllowList checks if the value is within the AllowList
 func (w AllowList) IsValid(value string) bool {
 	return w.Rule.IsValid(value)
 }
 // DenyList is a generic Rule for blacklisting
 type DenyList struct {
 	Rule
 }
 // IsValid for AllowList checks if the value is within the AllowList
 func (b DenyList) IsValid(value string) bool {
 	return !b.Rule.IsValid(value)
 }
 // Patterns is a list of strings to match against
 type Patterns []string
 // IsValid for Patterns checks each pattern and returns if a match has
 // been found
 func (p Patterns) IsValid(value string) bool {
 	for _, pattern := range p {
 		if sdkstrings.HasPrefixFold(value, pattern) {
 			return true
 		}
 	}
 	return false
 }
 // InclusiveRules rules allow for rules to depend on one another
 type InclusiveRules []Rule
 // IsValid will return true if all rules are true
 func (r InclusiveRules) IsValid(value string) bool {
 	for _, rule := range r {
 		if !rule.IsValid(value) {
 			return false
 		}
 	}
 	return true
 }
@@ -0,0 +1,68 @@
 package v4
 // IgnoredHeaders is a list of headers that are ignored during signing
 var IgnoredHeaders = Rules{
 	DenyList{
 		MapRule{
 			"Authorization":     struct{}{},
 			"User-Agent":        struct{}{},
 			"X-Amzn-Trace-Id":   struct{}{},
 			"Transfer-Encoding": struct{}{},
 		},
 	},
 }
 // RequiredSignedHeaders is a whitelist for Build canonical headers.
 var RequiredSignedHeaders = Rules{
 	AllowList{
 		MapRule{
 			"Cache-Control":                         struct{}{},
 			"Content-Disposition":                   struct{}{},
 			"Content-Encoding":                      struct{}{},
 			"Content-Language":                      struct{}{},
 			"Content-Md5":                           struct{}{},
 			"Content-Type":                          struct{}{},
 			"Expires":                               struct{}{},
 			"If-Match":                              struct{}{},
 			"If-Modified-Since":                     struct{}{},
 			"If-None-Match":                         struct{}{},
 			"If-Unmodified-Since":                   struct{}{},
 			"Range":                                 struct{}{},
 			"X-Amz-Acl":                             struct{}{},
 			"X-Amz-Copy-Source":                     struct{}{},
 			"X-Amz-Copy-Source-If-Match":            struct{}{},
 			"X-Amz-Copy-Source-If-Modified-Since":   struct{}{},
 			"X-Amz-Copy-Source-If-None-Match":       struct{}{},
 			"X-Amz-Copy-Source-If-Unmodified-Since": struct{}{},
 			"X-Amz-Copy-Source-Range":               struct{}{},
 			"X-Amz-Copy-Source-Server-Side-Encryption-Customer-Algorithm": struct{}{},
 			"X-Amz-Copy-Source-Server-Side-Encryption-Customer-Key":       struct{}{},
 			"X-Amz-Copy-Source-Server-Side-Encryption-Customer-Key-Md5":   struct{}{},
 			"X-Amz-Grant-Full-control":                                    struct{}{},
 			"X-Amz-Grant-Read":                                            struct{}{},
 			"X-Amz-Grant-Read-Acp":                                        struct{}{},
 			"X-Amz-Grant-Write":                                           struct{}{},
 			"X-Amz-Grant-Write-Acp":                                       struct{}{},
 			"X-Amz-Metadata-Directive":                                    struct{}{},
 			"X-Amz-Mfa":                                                   struct{}{},
 			"X-Amz-Request-Payer":                                         struct{}{},
 			"X-Amz-Server-Side-Encryption":                                struct{}{},
 			"X-Amz-Server-Side-Encryption-Aws-Kms-Key-Id":                 struct{}{},
 			"X-Amz-Server-Side-Encryption-Customer-Algorithm":             struct{}{},
 			"X-Amz-Server-Side-Encryption-Customer-Key":                   struct{}{},
 			"X-Amz-Server-Side-Encryption-Customer-Key-Md5":               struct{}{},
 			"X-Amz-Storage-Class":                                         struct{}{},
 			"X-Amz-Website-Redirect-Location":                             struct{}{},
 			"X-Amz-Content-Sha256":                                        struct{}{},
 			"X-Amz-Tagging":                                               struct{}{},
 		},
 	},
 	Patterns{"X-Amz-Meta-"},
 }
 // AllowedQueryHoisting is a whitelist for Build query headers. The boolean value
 // represents whether or not it is a pattern.
 var AllowedQueryHoisting = InclusiveRules{
 	DenyList{RequiredSignedHeaders},
 	Patterns{"X-Amz-"},
 }
@@ -0,0 +1,13 @@
 package v4
 import (
 	"crypto/hmac"
 	"crypto/sha256"
 )
 // HMACSHA256 computes a HMAC-SHA256 of data given the provided key.
 func HMACSHA256(key []byte, data []byte) []byte {
 	hash := hmac.New(sha256.New, key)
 	hash.Write(data)
 	return hash.Sum(nil)
 }
@@ -0,0 +1,75 @@
 package v4
 import (
 	"net/http"
 	"strings"
 )
 // SanitizeHostForHeader removes default port from host and updates request.Host
 func SanitizeHostForHeader(r *http.Request) {
 	host := getHost(r)
 	port := portOnly(host)
 	if port != "" && isDefaultPort(r.URL.Scheme, port) {
 		r.Host = stripPort(host)
 	}
 }
 // Returns host from request
 func getHost(r *http.Request) string {
 	if r.Host != "" {
 		return r.Host
 	}
 	return r.URL.Host
 }
 // Hostname returns u.Host, without any port number.
 //
 // If Host is an IPv6 literal with a port number, Hostname returns the
 // IPv6 literal without the square brackets. IPv6 literals may include
 // a zone identifier.
 //
 // Copied from the Go 1.8 standard library (net/url)
 func stripPort(hostport string) string {
 	colon := strings.IndexByte(hostport, ':')
 	if colon == -1 {
 		return hostport
 	}
 	if i := strings.IndexByte(hostport, ']'); i != -1 {
 		return strings.TrimPrefix(hostport[:i], "[")
 	}
 	return hostport[:colon]
 }
 // Port returns the port part of u.Host, without the leading colon.
 // If u.Host doesn't contain a port, Port returns an empty string.
 //
 // Copied from the Go 1.8 standard library (net/url)
 func portOnly(hostport string) string {
 	colon := strings.IndexByte(hostport, ':')
 	if colon == -1 {
 		return ""
 	}
 	if i := strings.Index(hostport, "]:"); i != -1 {
 		return hostport[i+len("]:"):]
 	}
 	if strings.Contains(hostport, "]") {
 		return ""
 	}
 	return hostport[colon+len(":"):]
 }
 // Returns true if the specified URI is using the standard port
 // (i.e. port 80 for HTTP URIs or 443 for HTTPS URIs)
 func isDefaultPort(scheme, port string) bool {
 	if port == "" {
 		return true
 	}
 	lowerCaseScheme := strings.ToLower(scheme)
 	if (lowerCaseScheme == "http" && port == "80") || (lowerCaseScheme == "https" && port == "443") {
 		return true
 	}
 	return false
 }
@@ -0,0 +1,36 @@
 package v4
 import "time"
 // SigningTime provides a wrapper around a time.Time which provides cached values for SigV4 signing.
 type SigningTime struct {
 	time.Time
 	timeFormat      string
 	shortTimeFormat string
 }
 // NewSigningTime creates a new SigningTime given a time.Time
 func NewSigningTime(t time.Time) SigningTime {
 	return SigningTime{
 		Time: t,
 	}
 }
 // TimeFormat provides a time formatted in the X-Amz-Date format.
 func (m *SigningTime) TimeFormat() string {
 	return m.format(&m.timeFormat, TimeFormat)
 }
 // ShortTimeFormat provides a time formatted of 20060102.
 func (m *SigningTime) ShortTimeFormat() string {
 	return m.format(&m.shortTimeFormat, ShortTimeFormat)
 }
 func (m *SigningTime) format(target *string, format string) string {
 	if len(*target) > 0 {
 		return *target
 	}
 	v := m.Time.Format(format)
 	*target = v
 	return v
 }
@@ -0,0 +1,64 @@
 package v4
 import (
 	"net/url"
 	"strings"
 )
 const doubleSpace = "  "
 // StripExcessSpaces will rewrite the passed in slice's string values to not
 // contain muliple side-by-side spaces.
 func StripExcessSpaces(str string) string {
 	var j, k, l, m, spaces int
 	// Trim trailing spaces
 	for j = len(str) - 1; j >= 0 && str[j] == ' '; j-- {
 	}
 	// Trim leading spaces
 	for k = 0; k < j && str[k] == ' '; k++ {
 	}
 	str = str[k : j+1]
 	// Strip multiple spaces.
 	j = strings.Index(str, doubleSpace)
 	if j < 0 {
 		return str
 	}
 	buf := []byte(str)
 	for k, m, l = j, j, len(buf); k < l; k++ {
 		if buf[k] == ' ' {
 			if spaces == 0 {
 				// First space.
 				buf[m] = buf[k]
 				m++
 			}
 			spaces++
 		} else {
 			// End of multiple spaces.
 			spaces = 0
 			buf[m] = buf[k]
 			m++
 		}
 	}
 	return string(buf[:m])
 }
 // GetURIPath returns the escaped URI component from the provided URL
 func GetURIPath(u *url.URL) string {
 	var uri string
 	if len(u.Opaque) > 0 {
 		uri = "/" + strings.Join(strings.Split(u.Opaque, "/")[3:], "/")
 	} else {
 		uri = u.EscapedPath()
 	}
 	if len(uri) == 0 {
 		uri = "/"
 	}
 	return uri
 }
@@ -0,0 +1,118 @@
 package v4a
 import (
 	"context"
 	"fmt"
 	awsmiddleware "github.com/aws/aws-sdk-go-v2/aws/middleware"
 	v4 "github.com/aws/aws-sdk-go-v2/aws/signer/v4"
 	internalauth "github.com/aws/aws-sdk-go-v2/internal/auth"
 	"github.com/aws/smithy-go/middleware"
 	smithyhttp "github.com/aws/smithy-go/transport/http"
 	"net/http"
 	"time"
 )
 // HTTPSigner is SigV4a HTTP signer implementation
 type HTTPSigner interface {
 	SignHTTP(ctx context.Context, credentials Credentials, r *http.Request, payloadHash string, service string, regionSet []string, signingTime time.Time, optfns ...func(*SignerOptions)) error
 }
 // SignHTTPRequestMiddlewareOptions is the middleware options for constructing a SignHTTPRequestMiddleware.
 type SignHTTPRequestMiddlewareOptions struct {
 	Credentials CredentialsProvider
 	Signer      HTTPSigner
 	LogSigning  bool
 }
 // SignHTTPRequestMiddleware is a middleware for signing an HTTP request using SigV4a.
 type SignHTTPRequestMiddleware struct {
 	credentials CredentialsProvider
 	signer      HTTPSigner
 	logSigning  bool
 }
 // NewSignHTTPRequestMiddleware constructs a SignHTTPRequestMiddleware using the given SignHTTPRequestMiddlewareOptions.
 func NewSignHTTPRequestMiddleware(options SignHTTPRequestMiddlewareOptions) *SignHTTPRequestMiddleware {
 	return &SignHTTPRequestMiddleware{
 		credentials: options.Credentials,
 		signer:      options.Signer,
 		logSigning:  options.LogSigning,
 	}
 }
 // ID the middleware identifier.
 func (s *SignHTTPRequestMiddleware) ID() string {
 	return "Signing"
 }
 // HandleFinalize signs an HTTP request using SigV4a.
 func (s *SignHTTPRequestMiddleware) HandleFinalize(
 	ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler,
 ) (
 	out middleware.FinalizeOutput, metadata middleware.Metadata, err error,
 ) {
 	if !hasCredentialProvider(s.credentials) {
 		return next.HandleFinalize(ctx, in)
 	}
 	req, ok := in.Request.(*smithyhttp.Request)
 	if !ok {
 		return out, metadata, fmt.Errorf("unexpected request middleware type %T", in.Request)
 	}
 	signingName, signingRegion := awsmiddleware.GetSigningName(ctx), awsmiddleware.GetSigningRegion(ctx)
 	payloadHash := v4.GetPayloadHash(ctx)
 	if len(payloadHash) == 0 {
 		return out, metadata, &SigningError{Err: fmt.Errorf("computed payload hash missing from context")}
 	}
 	credentials, err := s.credentials.RetrievePrivateKey(ctx)
 	if err != nil {
 		return out, metadata, &SigningError{Err: fmt.Errorf("failed to retrieve credentials: %w", err)}
 	}
 	signerOptions := []func(o *SignerOptions){
 		func(o *SignerOptions) {
 			o.Logger = middleware.GetLogger(ctx)
 			o.LogSigning = s.logSigning
 		},
 	}
 	// existing DisableURIPathEscaping is equivalent in purpose
 	// to authentication scheme property DisableDoubleEncoding
 	disableDoubleEncoding, overridden := internalauth.GetDisableDoubleEncoding(ctx)
 	if overridden {
 		signerOptions = append(signerOptions, func(o *SignerOptions) {
 			o.DisableURIPathEscaping = disableDoubleEncoding
 		})
 	}
 	err = s.signer.SignHTTP(ctx, credentials, req.Request, payloadHash, signingName, []string{signingRegion}, time.Now().UTC(), signerOptions...)
 	if err != nil {
 		return out, metadata, &SigningError{Err: fmt.Errorf("failed to sign http request, %w", err)}
 	}
 	return next.HandleFinalize(ctx, in)
 }
 func hasCredentialProvider(p CredentialsProvider) bool {
 	if p == nil {
 		return false
 	}
 	return true
 }
 // RegisterSigningMiddleware registers the SigV4a signing middleware to the stack. If a signing middleware is already
 // present, this provided middleware will be swapped. Otherwise the middleware will be added at the tail of the
 // finalize step.
 func RegisterSigningMiddleware(stack *middleware.Stack, signingMiddleware *SignHTTPRequestMiddleware) (err error) {
 	const signedID = "Signing"
 	_, present := stack.Finalize.Get(signedID)
 	if present {
 		_, err = stack.Finalize.Swap(signedID, signingMiddleware)
 	} else {
 		err = stack.Finalize.Add(signingMiddleware, middleware.After)
 	}
 	return err
 }
@@ -0,0 +1,117 @@
 package v4a
 import (
 	"context"
 	"fmt"
 	"net/http"
 	"time"
 	awsmiddleware "github.com/aws/aws-sdk-go-v2/aws/middleware"
 	v4 "github.com/aws/aws-sdk-go-v2/aws/signer/v4"
 	"github.com/aws/aws-sdk-go-v2/internal/sdk"
 	"github.com/aws/smithy-go/middleware"
 	smithyHTTP "github.com/aws/smithy-go/transport/http"
 )
 // HTTPPresigner is an interface to a SigV4a signer that can sign create a
 // presigned URL for a HTTP requests.
 type HTTPPresigner interface {
 	PresignHTTP(
 		ctx context.Context, credentials Credentials, r *http.Request,
 		payloadHash string, service string, regionSet []string, signingTime time.Time,
 		optFns ...func(*SignerOptions),
 	) (url string, signedHeader http.Header, err error)
 }
 // PresignHTTPRequestMiddlewareOptions is the options for the PresignHTTPRequestMiddleware middleware.
 type PresignHTTPRequestMiddlewareOptions struct {
 	CredentialsProvider CredentialsProvider
 	Presigner           HTTPPresigner
 	LogSigning          bool
 }
 // PresignHTTPRequestMiddleware provides the Finalize middleware for creating a
 // presigned URL for an HTTP request.
 //
 // Will short circuit the middleware stack and not forward onto the next
 // Finalize handler.
 type PresignHTTPRequestMiddleware struct {
 	credentialsProvider CredentialsProvider
 	presigner           HTTPPresigner
 	logSigning          bool
 }
 // NewPresignHTTPRequestMiddleware returns a new PresignHTTPRequestMiddleware
 // initialized with the presigner.
 func NewPresignHTTPRequestMiddleware(options PresignHTTPRequestMiddlewareOptions) *PresignHTTPRequestMiddleware {
 	return &PresignHTTPRequestMiddleware{
 		credentialsProvider: options.CredentialsProvider,
 		presigner:           options.Presigner,
 		logSigning:          options.LogSigning,
 	}
 }
 // ID provides the middleware ID.
 func (*PresignHTTPRequestMiddleware) ID() string { return "PresignHTTPRequest" }
 // HandleFinalize will take the provided input and create a presigned url for
 // the http request using the SigV4 presign authentication scheme.
 func (s *PresignHTTPRequestMiddleware) HandleFinalize(
 	ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler,
 ) (
 	out middleware.FinalizeOutput, metadata middleware.Metadata, err error,
 ) {
 	req, ok := in.Request.(*smithyHTTP.Request)
 	if !ok {
 		return out, metadata, &SigningError{
 			Err: fmt.Errorf("unexpected request middleware type %T", in.Request),
 		}
 	}
 	httpReq := req.Build(ctx)
 	if !hasCredentialProvider(s.credentialsProvider) {
 		out.Result = &v4.PresignedHTTPRequest{
 			URL:          httpReq.URL.String(),
 			Method:       httpReq.Method,
 			SignedHeader: http.Header{},
 		}
 		return out, metadata, nil
 	}
 	signingName := awsmiddleware.GetSigningName(ctx)
 	signingRegion := awsmiddleware.GetSigningRegion(ctx)
 	payloadHash := v4.GetPayloadHash(ctx)
 	if len(payloadHash) == 0 {
 		return out, metadata, &SigningError{
 			Err: fmt.Errorf("computed payload hash missing from context"),
 		}
 	}
 	credentials, err := s.credentialsProvider.RetrievePrivateKey(ctx)
 	if err != nil {
 		return out, metadata, &SigningError{
 			Err: fmt.Errorf("failed to retrieve credentials: %w", err),
 		}
 	}
 	u, h, err := s.presigner.PresignHTTP(ctx, credentials,
 		httpReq, payloadHash, signingName, []string{signingRegion}, sdk.NowTime(),
 		func(o *SignerOptions) {
 			o.Logger = middleware.GetLogger(ctx)
 			o.LogSigning = s.logSigning
 		})
 	if err != nil {
 		return out, metadata, &SigningError{
 			Err: fmt.Errorf("failed to sign http request, %w", err),
 		}
 	}
 	out.Result = &v4.PresignedHTTPRequest{
 		URL:          u,
 		Method:       httpReq.Method,
 		SignedHeader: h,
 	}
 	return out, metadata, nil
 }
@@ -0,0 +1,92 @@
 package v4a
 import (
 	"context"
 	"fmt"
 	"time"
 	internalcontext "github.com/aws/aws-sdk-go-v2/internal/context"
 	v4 "github.com/aws/aws-sdk-go-v2/aws/signer/v4"
 	"github.com/aws/aws-sdk-go-v2/internal/sdk"
 	"github.com/aws/smithy-go"
 	"github.com/aws/smithy-go/auth"
 	"github.com/aws/smithy-go/logging"
 	smithyhttp "github.com/aws/smithy-go/transport/http"
 )
 // CredentialsAdapter adapts v4a.Credentials to smithy auth.Identity.
 type CredentialsAdapter struct {
 	Credentials Credentials
 }
 var _ auth.Identity = (*CredentialsAdapter)(nil)
 // Expiration returns the time of expiration for the credentials.
 func (v *CredentialsAdapter) Expiration() time.Time {
 	return v.Credentials.Expires
 }
 // CredentialsProviderAdapter adapts v4a.CredentialsProvider to
 // auth.IdentityResolver.
 type CredentialsProviderAdapter struct {
 	Provider CredentialsProvider
 }
 var _ (auth.IdentityResolver) = (*CredentialsProviderAdapter)(nil)
 // GetIdentity retrieves v4a credentials using the underlying provider.
 func (v *CredentialsProviderAdapter) GetIdentity(ctx context.Context, _ smithy.Properties) (
 	auth.Identity, error,
 ) {
 	creds, err := v.Provider.RetrievePrivateKey(ctx)
 	if err != nil {
 		return nil, fmt.Errorf("get credentials: %w", err)
 	}
 	return &CredentialsAdapter{Credentials: creds}, nil
 }
 // SignerAdapter adapts v4a.HTTPSigner to smithy http.Signer.
 type SignerAdapter struct {
 	Signer     HTTPSigner
 	Logger     logging.Logger
 	LogSigning bool
 }
 var _ (smithyhttp.Signer) = (*SignerAdapter)(nil)
 // SignRequest signs the request with the provided identity.
 func (v *SignerAdapter) SignRequest(ctx context.Context, r *smithyhttp.Request, identity auth.Identity, props smithy.Properties) error {
 	ca, ok := identity.(*CredentialsAdapter)
 	if !ok {
 		return fmt.Errorf("unexpected identity type: %T", identity)
 	}
 	name, ok := smithyhttp.GetSigV4ASigningName(&props)
 	if !ok {
 		return fmt.Errorf("sigv4a signing name is required")
 	}
 	regions, ok := smithyhttp.GetSigV4ASigningRegions(&props)
 	if !ok {
 		return fmt.Errorf("sigv4a signing region is required")
 	}
 	hash := v4.GetPayloadHash(ctx)
 	signingTime := sdk.NowTime()
 	if skew := internalcontext.GetAttemptSkewContext(ctx); skew != 0 {
 		signingTime.Add(skew)
 	}
 	err := v.Signer.SignHTTP(ctx, ca.Credentials, r.Request, hash, name, regions, signingTime, func(o *SignerOptions) {
 		o.DisableURIPathEscaping, _ = smithyhttp.GetDisableDoubleEncoding(&props)
 		o.Logger = v.Logger
 		o.LogSigning = v.LogSigning
 	})
 	if err != nil {
 		return fmt.Errorf("sign http: %w", err)
 	}
 	return nil
 }
@@ -0,0 +1,520 @@
 package v4a
 import (
 	"bytes"
 	"context"
 	"crypto"
 	"crypto/ecdsa"
 	"crypto/elliptic"
 	"crypto/rand"
 	"crypto/sha256"
 	"encoding/hex"
 	"fmt"
 	"hash"
 	"math/big"
 	"net/http"
 	"net/textproto"
 	"net/url"
 	"sort"
 	"strconv"
 	"strings"
 	"time"
 	signerCrypto "github.com/aws/aws-sdk-go-v2/internal/v4a/internal/crypto"
 	v4Internal "github.com/aws/aws-sdk-go-v2/internal/v4a/internal/v4"
 	"github.com/aws/smithy-go/encoding/httpbinding"
 	"github.com/aws/smithy-go/logging"
 )
 const (
 	// AmzRegionSetKey represents the region set header used for sigv4a
 	AmzRegionSetKey     = "X-Amz-Region-Set"
 	amzAlgorithmKey     = v4Internal.AmzAlgorithmKey
 	amzSecurityTokenKey = v4Internal.AmzSecurityTokenKey
 	amzDateKey          = v4Internal.AmzDateKey
 	amzCredentialKey    = v4Internal.AmzCredentialKey
 	amzSignedHeadersKey = v4Internal.AmzSignedHeadersKey
 	authorizationHeader = "Authorization"
 	signingAlgorithm = "AWS4-ECDSA-P256-SHA256"
 	timeFormat      = "20060102T150405Z"
 	shortTimeFormat = "20060102"
 	// EmptyStringSHA256 is a hex encoded SHA-256 hash of an empty string
 	EmptyStringSHA256 = v4Internal.EmptyStringSHA256
 	// Version of signing v4a
 	Version = "SigV4A"
 )
 var (
 	p256          elliptic.Curve
 	nMinusTwoP256 *big.Int
 	one = new(big.Int).SetInt64(1)
 )
 func init() {
 	// Ensure the elliptic curve parameters are initialized on package import rather then on first usage
 	p256 = elliptic.P256()
 	nMinusTwoP256 = new(big.Int).SetBytes(p256.Params().N.Bytes())
 	nMinusTwoP256 = nMinusTwoP256.Sub(nMinusTwoP256, new(big.Int).SetInt64(2))
 }
 // SignerOptions is the SigV4a signing options for constructing a Signer.
 type SignerOptions struct {
 	Logger     logging.Logger
 	LogSigning bool
 	// Disables the Signer's moving HTTP header key/value pairs from the HTTP
 	// request header to the request's query string. This is most commonly used
 	// with pre-signed requests preventing headers from being added to the
 	// request's query string.
 	DisableHeaderHoisting bool
 	// Disables the automatic escaping of the URI path of the request for the
 	// siganture's canonical string's path. For services that do not need additional
 	// escaping then use this to disable the signer escaping the path.
 	//
 	// S3 is an example of a service that does not need additional escaping.
 	//
 	// http://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html
 	DisableURIPathEscaping bool
 }
 // Signer is a SigV4a HTTP signing implementation
 type Signer struct {
 	options SignerOptions
 }
 // NewSigner constructs a SigV4a Signer.
 func NewSigner(optFns ...func(*SignerOptions)) *Signer {
 	options := SignerOptions{}
 	for _, fn := range optFns {
 		fn(&options)
 	}
 	return &Signer{options: options}
 }
 // deriveKeyFromAccessKeyPair derives a NIST P-256 PrivateKey from the given
 // IAM AccessKey and SecretKey pair.
 //
 // Based on FIPS.186-4 Appendix B.4.2
 func deriveKeyFromAccessKeyPair(accessKey, secretKey string) (*ecdsa.PrivateKey, error) {
 	params := p256.Params()
 	bitLen := params.BitSize // Testing random candidates does not require an additional 64 bits
 	counter := 0x01
 	buffer := make([]byte, 1+len(accessKey)) // 1 byte counter + len(accessKey)
 	kdfContext := bytes.NewBuffer(buffer)
 	inputKey := append([]byte("AWS4A"), []byte(secretKey)...)
 	d := new(big.Int)
 	for {
 		kdfContext.Reset()
 		kdfContext.WriteString(accessKey)
 		kdfContext.WriteByte(byte(counter))
 		key, err := signerCrypto.HMACKeyDerivation(sha256.New, bitLen, inputKey, []byte(signingAlgorithm), kdfContext.Bytes())
 		if err != nil {
 			return nil, err
 		}
 		// Check key first before calling SetBytes if key key is in fact a valid candidate.
 		// This ensures the byte slice is the correct length (32-bytes) to compare in constant-time
 		cmp, err := signerCrypto.ConstantTimeByteCompare(key, nMinusTwoP256.Bytes())
 		if err != nil {
 			return nil, err
 		}
 		if cmp == -1 {
 			d.SetBytes(key)
 			break
 		}
 		counter++
 		if counter > 0xFF {
 			return nil, fmt.Errorf("exhausted single byte external counter")
 		}
 	}
 	d = d.Add(d, one)
 	priv := new(ecdsa.PrivateKey)
 	priv.PublicKey.Curve = p256
 	priv.D = d
 	priv.PublicKey.X, priv.PublicKey.Y = p256.ScalarBaseMult(d.Bytes())
 	return priv, nil
 }
 type httpSigner struct {
 	Request     *http.Request
 	ServiceName string
 	RegionSet   []string
 	Time        time.Time
 	Credentials Credentials
 	IsPreSign   bool
 	Logger logging.Logger
 	Debug  bool
 	// PayloadHash is the hex encoded SHA-256 hash of the request payload
 	// If len(PayloadHash) == 0 the signer will attempt to send the request
 	// as an unsigned payload. Note: Unsigned payloads only work for a subset of services.
 	PayloadHash string
 	DisableHeaderHoisting  bool
 	DisableURIPathEscaping bool
 }
 // SignHTTP takes the provided http.Request, payload hash, service, regionSet, and time and signs using SigV4a.
 // The passed in request will be modified in place.
 func (s *Signer) SignHTTP(ctx context.Context, credentials Credentials, r *http.Request, payloadHash string, service string, regionSet []string, signingTime time.Time, optFns ...func(*SignerOptions)) error {
 	options := s.options
 	for _, fn := range optFns {
 		fn(&options)
 	}
 	signer := &httpSigner{
 		Request:                r,
 		PayloadHash:            payloadHash,
 		ServiceName:            service,
 		RegionSet:              regionSet,
 		Credentials:            credentials,
 		Time:                   signingTime.UTC(),
 		DisableHeaderHoisting:  options.DisableHeaderHoisting,
 		DisableURIPathEscaping: options.DisableURIPathEscaping,
 	}
 	signedRequest, err := signer.Build()
 	if err != nil {
 		return err
 	}
 	logHTTPSigningInfo(ctx, options, signedRequest)
 	return nil
 }
 // PresignHTTP takes the provided http.Request, payload hash, service, regionSet, and time and presigns using SigV4a
 // Returns the presigned URL along with the headers that were signed with the request.
 //
 // PresignHTTP will not set the expires time of the presigned request
 // automatically. To specify the expire duration for a request add the
 // "X-Amz-Expires" query parameter on the request with the value as the
 // duration in seconds the presigned URL should be considered valid for. This
 // parameter is not used by all AWS services, and is most notable used by
 // Amazon S3 APIs.
 func (s *Signer) PresignHTTP(ctx context.Context, credentials Credentials, r *http.Request, payloadHash string, service string, regionSet []string, signingTime time.Time, optFns ...func(*SignerOptions)) (signedURI string, signedHeaders http.Header, err error) {
 	options := s.options
 	for _, fn := range optFns {
 		fn(&options)
 	}
 	signer := &httpSigner{
 		Request:                r,
 		PayloadHash:            payloadHash,
 		ServiceName:            service,
 		RegionSet:              regionSet,
 		Credentials:            credentials,
 		Time:                   signingTime.UTC(),
 		IsPreSign:              true,
 		DisableHeaderHoisting:  options.DisableHeaderHoisting,
 		DisableURIPathEscaping: options.DisableURIPathEscaping,
 	}
 	signedRequest, err := signer.Build()
 	if err != nil {
 		return "", nil, err
 	}
 	logHTTPSigningInfo(ctx, options, signedRequest)
 	signedHeaders = make(http.Header)
 	// For the signed headers we canonicalize the header keys in the returned map.
 	// This avoids situations where can standard library double headers like host header. For example the standard
 	// library will set the Host header, even if it is present in lower-case form.
 	for k, v := range signedRequest.SignedHeaders {
 		key := textproto.CanonicalMIMEHeaderKey(k)
 		signedHeaders[key] = append(signedHeaders[key], v...)
 	}
 	return signedRequest.Request.URL.String(), signedHeaders, nil
 }
 func (s *httpSigner) setRequiredSigningFields(headers http.Header, query url.Values) {
 	amzDate := s.Time.Format(timeFormat)
 	if s.IsPreSign {
 		query.Set(AmzRegionSetKey, strings.Join(s.RegionSet, ","))
 		query.Set(amzDateKey, amzDate)
 		query.Set(amzAlgorithmKey, signingAlgorithm)
 		if len(s.Credentials.SessionToken) > 0 {
 			query.Set(amzSecurityTokenKey, s.Credentials.SessionToken)
 		}
 		return
 	}
 	headers.Set(AmzRegionSetKey, strings.Join(s.RegionSet, ","))
 	headers.Set(amzDateKey, amzDate)
 	if len(s.Credentials.SessionToken) > 0 {
 		headers.Set(amzSecurityTokenKey, s.Credentials.SessionToken)
 	}
 }
 func (s *httpSigner) Build() (signedRequest, error) {
 	req := s.Request
 	query := req.URL.Query()
 	headers := req.Header
 	s.setRequiredSigningFields(headers, query)
 	// Sort Each Query Key's Values
 	for key := range query {
 		sort.Strings(query[key])
 	}
 	v4Internal.SanitizeHostForHeader(req)
 	credentialScope := s.buildCredentialScope()
 	credentialStr := s.Credentials.Context + "/" + credentialScope
 	if s.IsPreSign {
 		query.Set(amzCredentialKey, credentialStr)
 	}
 	unsignedHeaders := headers
 	if s.IsPreSign && !s.DisableHeaderHoisting {
 		urlValues := url.Values{}
 		urlValues, unsignedHeaders = buildQuery(v4Internal.AllowedQueryHoisting, unsignedHeaders)
 		for k := range urlValues {
 			query[k] = urlValues[k]
 		}
 	}
 	host := req.URL.Host
 	if len(req.Host) > 0 {
 		host = req.Host
 	}
 	signedHeaders, signedHeadersStr, canonicalHeaderStr := s.buildCanonicalHeaders(host, v4Internal.IgnoredHeaders, unsignedHeaders, s.Request.ContentLength)
 	if s.IsPreSign {
 		query.Set(amzSignedHeadersKey, signedHeadersStr)
 	}
 	rawQuery := strings.Replace(query.Encode(), "+", "%20", -1)
 	canonicalURI := v4Internal.GetURIPath(req.URL)
 	if !s.DisableURIPathEscaping {
 		canonicalURI = httpbinding.EscapePath(canonicalURI, false)
 	}
 	canonicalString := s.buildCanonicalString(
 		req.Method,
 		canonicalURI,
 		rawQuery,
 		signedHeadersStr,
 		canonicalHeaderStr,
 	)
 	strToSign := s.buildStringToSign(credentialScope, canonicalString)
 	signingSignature, err := s.buildSignature(strToSign)
 	if err != nil {
 		return signedRequest{}, err
 	}
 	if s.IsPreSign {
 		rawQuery += "&X-Amz-Signature=" + signingSignature
 	} else {
 		headers[authorizationHeader] = append(headers[authorizationHeader][:0], buildAuthorizationHeader(credentialStr, signedHeadersStr, signingSignature))
 	}
 	req.URL.RawQuery = rawQuery
 	return signedRequest{
 		Request:         req,
 		SignedHeaders:   signedHeaders,
 		CanonicalString: canonicalString,
 		StringToSign:    strToSign,
 		PreSigned:       s.IsPreSign,
 	}, nil
 }
 func buildAuthorizationHeader(credentialStr, signedHeadersStr, signingSignature string) string {
 	const credential = "Credential="
 	const signedHeaders = "SignedHeaders="
 	const signature = "Signature="
 	const commaSpace = ", "
 	var parts strings.Builder
 	parts.Grow(len(signingAlgorithm) + 1 +
 		len(credential) + len(credentialStr) + len(commaSpace) +
 		len(signedHeaders) + len(signedHeadersStr) + len(commaSpace) +
 		len(signature) + len(signingSignature),
 	)
 	parts.WriteString(signingAlgorithm)
 	parts.WriteRune(' ')
 	parts.WriteString(credential)
 	parts.WriteString(credentialStr)
 	parts.WriteString(commaSpace)
 	parts.WriteString(signedHeaders)
 	parts.WriteString(signedHeadersStr)
 	parts.WriteString(commaSpace)
 	parts.WriteString(signature)
 	parts.WriteString(signingSignature)
 	return parts.String()
 }
 func (s *httpSigner) buildCredentialScope() string {
 	return strings.Join([]string{
 		s.Time.Format(shortTimeFormat),
 		s.ServiceName,
 		"aws4_request",
 	}, "/")
 }
 func buildQuery(r v4Internal.Rule, header http.Header) (url.Values, http.Header) {
 	query := url.Values{}
 	unsignedHeaders := http.Header{}
 	for k, h := range header {
 		if r.IsValid(k) {
 			query[k] = h
 		} else {
 			unsignedHeaders[k] = h
 		}
 	}
 	return query, unsignedHeaders
 }
 func (s *httpSigner) buildCanonicalHeaders(host string, rule v4Internal.Rule, header http.Header, length int64) (signed http.Header, signedHeaders, canonicalHeadersStr string) {
 	signed = make(http.Header)
 	var headers []string
 	const hostHeader = "host"
 	headers = append(headers, hostHeader)
 	signed[hostHeader] = append(signed[hostHeader], host)
 	if length > 0 {
 		const contentLengthHeader = "content-length"
 		headers = append(headers, contentLengthHeader)
 		signed[contentLengthHeader] = append(signed[contentLengthHeader], strconv.FormatInt(length, 10))
 	}
 	for k, v := range header {
 		if !rule.IsValid(k) {
 			continue // ignored header
 		}
 		lowerCaseKey := strings.ToLower(k)
 		if _, ok := signed[lowerCaseKey]; ok {
 			// include additional values
 			signed[lowerCaseKey] = append(signed[lowerCaseKey], v...)
 			continue
 		}
 		headers = append(headers, lowerCaseKey)
 		signed[lowerCaseKey] = v
 	}
 	sort.Strings(headers)
 	signedHeaders = strings.Join(headers, ";")
 	var canonicalHeaders strings.Builder
 	n := len(headers)
 	const colon = ':'
 	for i := range n {
 		if headers[i] == hostHeader {
 			canonicalHeaders.WriteString(hostHeader)
 			canonicalHeaders.WriteRune(colon)
 			canonicalHeaders.WriteString(v4Internal.StripExcessSpaces(host))
 		} else {
 			canonicalHeaders.WriteString(headers[i])
 			canonicalHeaders.WriteRune(colon)
 			// Trim out leading, trailing, and dedup inner spaces from signed header values.
 			values := signed[headers[i]]
 			for j, v := range values {
 				cleanedValue := strings.TrimSpace(v4Internal.StripExcessSpaces(v))
 				canonicalHeaders.WriteString(cleanedValue)
 				if j < len(values)-1 {
 					canonicalHeaders.WriteRune(',')
 				}
 			}
 		}
 		canonicalHeaders.WriteRune('\n')
 	}
 	canonicalHeadersStr = canonicalHeaders.String()
 	return signed, signedHeaders, canonicalHeadersStr
 }
 func (s *httpSigner) buildCanonicalString(method, uri, query, signedHeaders, canonicalHeaders string) string {
 	return strings.Join([]string{
 		method,
 		uri,
 		query,
 		canonicalHeaders,
 		signedHeaders,
 		s.PayloadHash,
 	}, "\n")
 }
 func (s *httpSigner) buildStringToSign(credentialScope, canonicalRequestString string) string {
 	return strings.Join([]string{
 		signingAlgorithm,
 		s.Time.Format(timeFormat),
 		credentialScope,
 		hex.EncodeToString(makeHash(sha256.New(), []byte(canonicalRequestString))),
 	}, "\n")
 }
 func makeHash(hash hash.Hash, b []byte) []byte {
 	hash.Reset()
 	hash.Write(b)
 	return hash.Sum(nil)
 }
 func (s *httpSigner) buildSignature(strToSign string) (string, error) {
 	sig, err := s.Credentials.PrivateKey.Sign(rand.Reader, makeHash(sha256.New(), []byte(strToSign)), crypto.SHA256)
 	if err != nil {
 		return "", err
 	}
 	return hex.EncodeToString(sig), nil
 }
 const logSignInfoMsg = `Request Signature:
 ---[ CANONICAL STRING  ]-----------------------------
 %s
 ---[ STRING TO SIGN ]--------------------------------
 %s%s
 -----------------------------------------------------`
 const logSignedURLMsg = `
 ---[ SIGNED URL ]------------------------------------
 %s`
 func logHTTPSigningInfo(ctx context.Context, options SignerOptions, r signedRequest) {
 	if !options.LogSigning {
 		return
 	}
 	signedURLMsg := ""
 	if r.PreSigned {
 		signedURLMsg = fmt.Sprintf(logSignedURLMsg, r.Request.URL.String())
 	}
 	logger := logging.WithContext(ctx, options.Logger)
 	logger.Logf(logging.Debug, logSignInfoMsg, r.CanonicalString, r.StringToSign, signedURLMsg)
 }
 type signedRequest struct {
 	Request         *http.Request
 	SignedHeaders   http.Header
 	CanonicalString string
 	StringToSign    string
 	PreSigned       bool
 }
@@ -1,3 +1,11 @@
 # v1.13.9 (2026-04-29)
 * **Dependency Update**: Update to smithy-go v1.25.1.
 # v1.13.8 (2026-04-17)
 * **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
 # v1.13.7 (2026-03-13)
 * **Bug Fix**: Replace usages of the old ioutil/ package throughout the SDK.
@@ -3,4 +3,4 @@
 package acceptencoding
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.13.7"
+const goModuleVersion = "1.13.9"
@@ -1,3 +1,17 @@
 # v1.13.23 (2026-04-29)
 * **Dependency Update**: Update to smithy-go v1.25.1.
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.13.22 (2026-04-17)
 * **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.13.21 (2026-03-26)
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.13.20 (2026-03-13)
 * **Dependency Update**: Updated to the latest SDK module versions
@@ -3,4 +3,4 @@
 package presignedurl
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.13.20"
+const goModuleVersion = "1.13.23"
@@ -1,3 +1,18 @@
 # v1.0.11 (2026-04-29)
 * **Dependency Update**: Update to smithy-go v1.25.1.
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.10 (2026-04-17)
 * **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.9 (2026-03-26)
 * **Bug Fix**: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.0.8 (2026-03-13)
 * **Dependency Update**: Updated to the latest SDK module versions
@@ -15,9 +15,7 @@ import (
 	internalauth "github.com/aws/aws-sdk-go-v2/internal/auth"
 	internalauthsmithy "github.com/aws/aws-sdk-go-v2/internal/auth/smithy"
 	internalConfig "github.com/aws/aws-sdk-go-v2/internal/configsources"
 	internalmiddleware "github.com/aws/aws-sdk-go-v2/internal/middleware"
 	smithy "github.com/aws/smithy-go"
 	smithyauth "github.com/aws/smithy-go/auth"
 	smithydocument "github.com/aws/smithy-go/document"
 	"github.com/aws/smithy-go/logging"
 	"github.com/aws/smithy-go/metrics"
@@ -711,10 +709,11 @@ func addIsPaginatorUserAgent(o *Options) {
 	})
 }
-func addRetry(stack *middleware.Stack, o Options) error {
+func addRetry(stack *middleware.Stack, o Options, c *Client) error {
 	attempt := retry.NewAttemptMiddleware(o.Retryer, smithyhttp.RequestCloner, func(m *retry.Attempt) {
 		m.LogAttempts = o.ClientLogMode.IsRetries()
 		m.OperationMeter = o.MeterProvider.Meter("github.com/aws/aws-sdk-go-v2/service/signin")
 		m.ClientSkew = c.timeOffset
 	})
 	if err := stack.Finalize.Insert(attempt, "ResolveAuthScheme", middleware.Before); err != nil {
 		return err
@@ -755,25 +754,6 @@ func resolveUseFIPSEndpoint(cfg aws.Config, o *Options) error {
 	return nil
 }
 func resolveAccountID(identity smithyauth.Identity, mode aws.AccountIDEndpointMode) *string {
 	if mode == aws.AccountIDEndpointModeDisabled {
 		return nil
 	}
 	if ca, ok := identity.(*internalauthsmithy.CredentialsAdapter); ok && ca.Credentials.AccountID != "" {
 		return aws.String(ca.Credentials.AccountID)
 	}
 	return nil
 }
 func addTimeOffsetBuild(stack *middleware.Stack, c *Client) error {
 	mw := internalmiddleware.AddTimeOffsetMiddleware{Offset: c.timeOffset}
 	if err := stack.Build.Add(&mw, middleware.After); err != nil {
 		return err
 	}
 	return stack.Deserialize.Insert(&mw, "RecordResponseTiming", middleware.Before)
 }
 func initializeTimeOffsetResolver(c *Client) {
 	c.timeOffset = new(atomic.Int64)
 }
@@ -134,7 +134,7 @@ func (c *Client) addOperationCreateOAuth2TokenMiddlewares(stack *middleware.Stac
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -158,9 +158,6 @@ func (c *Client) addOperationCreateOAuth2TokenMiddlewares(stack *middleware.Stac
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
 	if err = addTimeOffsetBuild(stack, c); err != nil {
 		return err
 	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
@@ -3,4 +3,4 @@
 package signin
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.0.8"
+const goModuleVersion = "1.0.11"
@@ -1,3 +1,22 @@
 # v1.30.17 (2026-04-29)
 * **Dependency Update**: Update to smithy-go v1.25.1.
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.30.16 (2026-04-17)
 * **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.30.15 (2026-04-02)
 * No change notes available for this release.
 # v1.30.14 (2026-03-26)
 * **Bug Fix**: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.30.13 (2026-03-13)
 * **Dependency Update**: Updated to the latest SDK module versions
@@ -15,9 +15,7 @@ import (
 	internalauth "github.com/aws/aws-sdk-go-v2/internal/auth"
 	internalauthsmithy "github.com/aws/aws-sdk-go-v2/internal/auth/smithy"
 	internalConfig "github.com/aws/aws-sdk-go-v2/internal/configsources"
 	internalmiddleware "github.com/aws/aws-sdk-go-v2/internal/middleware"
 	smithy "github.com/aws/smithy-go"
 	smithyauth "github.com/aws/smithy-go/auth"
 	smithydocument "github.com/aws/smithy-go/document"
 	"github.com/aws/smithy-go/logging"
 	"github.com/aws/smithy-go/metrics"
@@ -711,10 +709,11 @@ func addIsPaginatorUserAgent(o *Options) {
 	})
 }
-func addRetry(stack *middleware.Stack, o Options) error {
+func addRetry(stack *middleware.Stack, o Options, c *Client) error {
 	attempt := retry.NewAttemptMiddleware(o.Retryer, smithyhttp.RequestCloner, func(m *retry.Attempt) {
 		m.LogAttempts = o.ClientLogMode.IsRetries()
 		m.OperationMeter = o.MeterProvider.Meter("github.com/aws/aws-sdk-go-v2/service/sso")
 		m.ClientSkew = c.timeOffset
 	})
 	if err := stack.Finalize.Insert(attempt, "ResolveAuthScheme", middleware.Before); err != nil {
 		return err
@@ -755,25 +754,6 @@ func resolveUseFIPSEndpoint(cfg aws.Config, o *Options) error {
 	return nil
 }
 func resolveAccountID(identity smithyauth.Identity, mode aws.AccountIDEndpointMode) *string {
 	if mode == aws.AccountIDEndpointModeDisabled {
 		return nil
 	}
 	if ca, ok := identity.(*internalauthsmithy.CredentialsAdapter); ok && ca.Credentials.AccountID != "" {
 		return aws.String(ca.Credentials.AccountID)
 	}
 	return nil
 }
 func addTimeOffsetBuild(stack *middleware.Stack, c *Client) error {
 	mw := internalmiddleware.AddTimeOffsetMiddleware{Offset: c.timeOffset}
 	if err := stack.Build.Add(&mw, middleware.After); err != nil {
 		return err
 	}
 	return stack.Deserialize.Insert(&mw, "RecordResponseTiming", middleware.Before)
 }
 func initializeTimeOffsetResolver(c *Client) {
 	c.timeOffset = new(atomic.Int64)
 }
@@ -93,7 +93,7 @@ func (c *Client) addOperationGetRoleCredentialsMiddlewares(stack *middleware.Sta
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -117,9 +117,6 @@ func (c *Client) addOperationGetRoleCredentialsMiddlewares(stack *middleware.Sta
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
 	if err = addTimeOffsetBuild(stack, c); err != nil {
 		return err
 	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
@@ -98,7 +98,7 @@ func (c *Client) addOperationListAccountRolesMiddlewares(stack *middleware.Stack
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -122,9 +122,6 @@ func (c *Client) addOperationListAccountRolesMiddlewares(stack *middleware.Stack
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
 	if err = addTimeOffsetBuild(stack, c); err != nil {
 		return err
 	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
@@ -97,7 +97,7 @@ func (c *Client) addOperationListAccountsMiddlewares(stack *middleware.Stack, op
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -121,9 +121,6 @@ func (c *Client) addOperationListAccountsMiddlewares(stack *middleware.Stack, op
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
 	if err = addTimeOffsetBuild(stack, c); err != nil {
 		return err
 	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
@@ -92,7 +92,7 @@ func (c *Client) addOperationLogoutMiddlewares(stack *middleware.Stack, options
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -116,9 +116,6 @@ func (c *Client) addOperationLogoutMiddlewares(stack *middleware.Stack, options
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
 	if err = addTimeOffsetBuild(stack, c); err != nil {
 		return err
 	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
@@ -3,4 +3,4 @@
 package sso
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.30.13"
+const goModuleVersion = "1.30.17"
@@ -482,6 +482,11 @@ var defaultPartitions = endpoints.Partitions{
 		},
 		RegionRegex:    partitionRegexp.AwsEusc,
 		IsRegionalized: true,
 		Endpoints: endpoints.Endpoints{
 			endpoints.EndpointKey{
 				Region: "eusc-de-east-1",
 			}: endpoints.Endpoint{},
 		},
 	},
 	{
 		ID: "aws-iso",
@@ -1,3 +1,22 @@
 # v1.35.21 (2026-04-29)
 * **Dependency Update**: Update to smithy-go v1.25.1.
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.35.20 (2026-04-17)
 * **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.35.19 (2026-04-02)
 * No change notes available for this release.
 # v1.35.18 (2026-03-26)
 * **Bug Fix**: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.35.17 (2026-03-13)
 * **Dependency Update**: Updated to the latest SDK module versions
@@ -15,9 +15,7 @@ import (
 	internalauth "github.com/aws/aws-sdk-go-v2/internal/auth"
 	internalauthsmithy "github.com/aws/aws-sdk-go-v2/internal/auth/smithy"
 	internalConfig "github.com/aws/aws-sdk-go-v2/internal/configsources"
 	internalmiddleware "github.com/aws/aws-sdk-go-v2/internal/middleware"
 	smithy "github.com/aws/smithy-go"
 	smithyauth "github.com/aws/smithy-go/auth"
 	smithydocument "github.com/aws/smithy-go/document"
 	"github.com/aws/smithy-go/logging"
 	"github.com/aws/smithy-go/metrics"
@@ -711,10 +709,11 @@ func addIsPaginatorUserAgent(o *Options) {
 	})
 }
-func addRetry(stack *middleware.Stack, o Options) error {
+func addRetry(stack *middleware.Stack, o Options, c *Client) error {
 	attempt := retry.NewAttemptMiddleware(o.Retryer, smithyhttp.RequestCloner, func(m *retry.Attempt) {
 		m.LogAttempts = o.ClientLogMode.IsRetries()
 		m.OperationMeter = o.MeterProvider.Meter("github.com/aws/aws-sdk-go-v2/service/ssooidc")
 		m.ClientSkew = c.timeOffset
 	})
 	if err := stack.Finalize.Insert(attempt, "ResolveAuthScheme", middleware.Before); err != nil {
 		return err
@@ -755,25 +754,6 @@ func resolveUseFIPSEndpoint(cfg aws.Config, o *Options) error {
 	return nil
 }
 func resolveAccountID(identity smithyauth.Identity, mode aws.AccountIDEndpointMode) *string {
 	if mode == aws.AccountIDEndpointModeDisabled {
 		return nil
 	}
 	if ca, ok := identity.(*internalauthsmithy.CredentialsAdapter); ok && ca.Credentials.AccountID != "" {
 		return aws.String(ca.Credentials.AccountID)
 	}
 	return nil
 }
 func addTimeOffsetBuild(stack *middleware.Stack, c *Client) error {
 	mw := internalmiddleware.AddTimeOffsetMiddleware{Offset: c.timeOffset}
 	if err := stack.Build.Add(&mw, middleware.After); err != nil {
 		return err
 	}
 	return stack.Deserialize.Insert(&mw, "RecordResponseTiming", middleware.Before)
 }
 func initializeTimeOffsetResolver(c *Client) {
 	c.timeOffset = new(atomic.Int64)
 }
@@ -163,7 +163,7 @@ func (c *Client) addOperationCreateTokenMiddlewares(stack *middleware.Stack, opt
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -187,9 +187,6 @@ func (c *Client) addOperationCreateTokenMiddlewares(stack *middleware.Stack, opt
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
 	if err = addTimeOffsetBuild(stack, c); err != nil {
 		return err
 	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
@@ -210,7 +210,7 @@ func (c *Client) addOperationCreateTokenWithIAMMiddlewares(stack *middleware.Sta
 	if err = addComputePayloadSHA256(stack); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -234,9 +234,6 @@ func (c *Client) addOperationCreateTokenWithIAMMiddlewares(stack *middleware.Sta
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
 	if err = addTimeOffsetBuild(stack, c); err != nil {
 		return err
 	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
@@ -134,7 +134,7 @@ func (c *Client) addOperationRegisterClientMiddlewares(stack *middleware.Stack,
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -158,9 +158,6 @@ func (c *Client) addOperationRegisterClientMiddlewares(stack *middleware.Stack,
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
 	if err = addTimeOffsetBuild(stack, c); err != nil {
 		return err
 	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
@@ -116,7 +116,7 @@ func (c *Client) addOperationStartDeviceAuthorizationMiddlewares(stack *middlewa
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -140,9 +140,6 @@ func (c *Client) addOperationStartDeviceAuthorizationMiddlewares(stack *middlewa
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
 	if err = addTimeOffsetBuild(stack, c); err != nil {
 		return err
 	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
@@ -3,4 +3,4 @@
 package ssooidc
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.35.17"
+const goModuleVersion = "1.35.21"
@@ -482,6 +482,11 @@ var defaultPartitions = endpoints.Partitions{
 		},
 		RegionRegex:    partitionRegexp.AwsEusc,
 		IsRegionalized: true,
 		Endpoints: endpoints.Endpoints{
 			endpoints.EndpointKey{
 				Region: "eusc-de-east-1",
 			}: endpoints.Endpoint{},
 		},
 	},
 	{
 		ID: "aws-iso",
@@ -1,3 +1,19 @@
 # v1.42.1 (2026-04-29)
 * **Dependency Update**: Update to smithy-go v1.25.1.
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.42.0 (2026-04-17)
 * **Feature**: The STS client now supports configuring SigV4a through the auth scheme preference setting. SigV4a uses asymmetric cryptography, enabling customers using long-term IAM credentials to continue making STS API calls even when a region is isolated from the partition leader.
 * **Dependency Update**: Bump smithy-go to 1.25.0 to support endpointBdd trait
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.41.10 (2026-03-26)
 * **Bug Fix**: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
 * **Dependency Update**: Updated to the latest SDK module versions
 # v1.41.9 (2026-03-13)
 * **Dependency Update**: Updated to the latest SDK module versions
@@ -16,11 +16,10 @@ import (
 	internalauth "github.com/aws/aws-sdk-go-v2/internal/auth"
 	internalauthsmithy "github.com/aws/aws-sdk-go-v2/internal/auth/smithy"
 	internalConfig "github.com/aws/aws-sdk-go-v2/internal/configsources"
-	internalmiddleware "github.com/aws/aws-sdk-go-v2/internal/middleware"
+	"github.com/aws/aws-sdk-go-v2/internal/v4a"
 	acceptencodingcust "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding"
 	presignedurlcust "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url"
 	smithy "github.com/aws/smithy-go"
 	smithyauth "github.com/aws/smithy-go/auth"
 	smithydocument "github.com/aws/smithy-go/document"
 	"github.com/aws/smithy-go/logging"
 	"github.com/aws/smithy-go/metrics"
@@ -209,6 +208,8 @@ func New(options Options, optFns ...func(*Options)) *Client {
 	resolveEndpointResolverV2(&options)
 	resolveHTTPSignerV4a(&options)
 	resolveTracerProvider(&options)
 	resolveMeterProvider(&options)
@@ -383,6 +384,11 @@ func resolveAuthSchemes(options *Options) {
 				Logger:     options.Logger,
 				LogSigning: options.ClientLogMode.IsSigning(),
 			}),
 			internalauth.NewHTTPAuthScheme("aws.auth#sigv4a", &v4a.SignerAdapter{
 				Signer:     options.httpSignerV4a,
 				Logger:     options.Logger,
 				LogSigning: options.ClientLogMode.IsSigning(),
 			}),
 		}
 	}
 }
@@ -715,10 +721,11 @@ func addIsPaginatorUserAgent(o *Options) {
 	})
 }
-func addRetry(stack *middleware.Stack, o Options) error {
+func addRetry(stack *middleware.Stack, o Options, c *Client) error {
 	attempt := retry.NewAttemptMiddleware(o.Retryer, smithyhttp.RequestCloner, func(m *retry.Attempt) {
 		m.LogAttempts = o.ClientLogMode.IsRetries()
 		m.OperationMeter = o.MeterProvider.Meter("github.com/aws/aws-sdk-go-v2/service/sts")
 		m.ClientSkew = c.timeOffset
 	})
 	if err := stack.Finalize.Insert(attempt, "ResolveAuthScheme", middleware.Before); err != nil {
 		return err
@@ -759,25 +766,26 @@ func resolveUseFIPSEndpoint(cfg aws.Config, o *Options) error {
 	return nil
 }
-func resolveAccountID(identity smithyauth.Identity, mode aws.AccountIDEndpointMode) *string {
+type httpSignerV4a interface {
-	if mode == aws.AccountIDEndpointModeDisabled {
+	SignHTTP(ctx context.Context, credentials v4a.Credentials, r *http.Request, payloadHash,
-		return nil
+		service string, regionSet []string, signingTime time.Time,
-	}
+		optFns ...func(*v4a.SignerOptions)) error
 	if ca, ok := identity.(*internalauthsmithy.CredentialsAdapter); ok && ca.Credentials.AccountID != "" {
 		return aws.String(ca.Credentials.AccountID)
 	}
 	return nil
 }
-func addTimeOffsetBuild(stack *middleware.Stack, c *Client) error {
+func resolveHTTPSignerV4a(o *Options) {
-	mw := internalmiddleware.AddTimeOffsetMiddleware{Offset: c.timeOffset}
+	if o.httpSignerV4a != nil {
-	if err := stack.Build.Add(&mw, middleware.After); err != nil {
+		return
 		return err
 	}
-	return stack.Deserialize.Insert(&mw, "RecordResponseTiming", middleware.Before)
+	o.httpSignerV4a = newDefaultV4aSigner(*o)
 }
 func newDefaultV4aSigner(o Options) *v4a.Signer {
 	return v4a.NewSigner(func(so *v4a.SignerOptions) {
 		so.Logger = o.Logger
 		so.LogSigning = o.ClientLogMode.IsSigning()
 	})
 }
 func initializeTimeOffsetResolver(c *Client) {
 	c.timeOffset = new(atomic.Int64)
 }
@@ -448,7 +448,7 @@ func (c *Client) addOperationAssumeRoleMiddlewares(stack *middleware.Stack, opti
 	if err = addComputePayloadSHA256(stack); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -472,9 +472,6 @@ func (c *Client) addOperationAssumeRoleMiddlewares(stack *middleware.Stack, opti
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
 	if err = addTimeOffsetBuild(stack, c); err != nil {
 		return err
 	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
@@ -383,7 +383,7 @@ func (c *Client) addOperationAssumeRoleWithSAMLMiddlewares(stack *middleware.Sta
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -407,9 +407,6 @@ func (c *Client) addOperationAssumeRoleWithSAMLMiddlewares(stack *middleware.Sta
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
 	if err = addTimeOffsetBuild(stack, c); err != nil {
 		return err
 	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
@@ -400,7 +400,7 @@ func (c *Client) addOperationAssumeRoleWithWebIdentityMiddlewares(stack *middlew
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -424,9 +424,6 @@ func (c *Client) addOperationAssumeRoleWithWebIdentityMiddlewares(stack *middlew
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
 	if err = addTimeOffsetBuild(stack, c); err != nil {
 		return err
 	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
@@ -157,7 +157,7 @@ func (c *Client) addOperationAssumeRootMiddlewares(stack *middleware.Stack, opti
 	if err = addComputePayloadSHA256(stack); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -181,9 +181,6 @@ func (c *Client) addOperationAssumeRootMiddlewares(stack *middleware.Stack, opti
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
 	if err = addTimeOffsetBuild(stack, c); err != nil {
 		return err
 	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
@@ -117,7 +117,7 @@ func (c *Client) addOperationDecodeAuthorizationMessageMiddlewares(stack *middle
 	if err = addComputePayloadSHA256(stack); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -141,9 +141,6 @@ func (c *Client) addOperationDecodeAuthorizationMessageMiddlewares(stack *middle
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
 	if err = addTimeOffsetBuild(stack, c); err != nil {
 		return err
 	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
@@ -108,7 +108,7 @@ func (c *Client) addOperationGetAccessKeyInfoMiddlewares(stack *middleware.Stack
 	if err = addComputePayloadSHA256(stack); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -132,9 +132,6 @@ func (c *Client) addOperationGetAccessKeyInfoMiddlewares(stack *middleware.Stack
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
 	if err = addTimeOffsetBuild(stack, c); err != nil {
 		return err
 	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
@@ -99,7 +99,7 @@ func (c *Client) addOperationGetCallerIdentityMiddlewares(stack *middleware.Stac
 	if err = addComputePayloadSHA256(stack); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -123,9 +123,6 @@ func (c *Client) addOperationGetCallerIdentityMiddlewares(stack *middleware.Stac
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
 	if err = addTimeOffsetBuild(stack, c); err != nil {
 		return err
 	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
@@ -97,7 +97,7 @@ func (c *Client) addOperationGetDelegatedAccessTokenMiddlewares(stack *middlewar
 	if err = addComputePayloadSHA256(stack); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -121,9 +121,6 @@ func (c *Client) addOperationGetDelegatedAccessTokenMiddlewares(stack *middlewar
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
 	if err = addTimeOffsetBuild(stack, c); err != nil {
 		return err
 	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
@@ -321,7 +321,7 @@ func (c *Client) addOperationGetFederationTokenMiddlewares(stack *middleware.Sta
 	if err = addComputePayloadSHA256(stack); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -345,9 +345,6 @@ func (c *Client) addOperationGetFederationTokenMiddlewares(stack *middleware.Sta
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
 	if err = addTimeOffsetBuild(stack, c); err != nil {
 		return err
 	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
@@ -170,7 +170,7 @@ func (c *Client) addOperationGetSessionTokenMiddlewares(stack *middleware.Stack,
 	if err = addComputePayloadSHA256(stack); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -194,9 +194,6 @@ func (c *Client) addOperationGetSessionTokenMiddlewares(stack *middleware.Stack,
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
 	if err = addTimeOffsetBuild(stack, c); err != nil {
 		return err
 	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
@@ -120,7 +120,7 @@ func (c *Client) addOperationGetWebIdentityTokenMiddlewares(stack *middleware.St
 	if err = addComputePayloadSHA256(stack); err != nil {
 		return err
 	}
-	if err = addRetry(stack, options); err != nil {
+	if err = addRetry(stack, options, c); err != nil {
 		return err
 	}
 	if err = addRawResponseToMetadata(stack); err != nil {
@@ -144,9 +144,6 @@ func (c *Client) addOperationGetWebIdentityTokenMiddlewares(stack *middleware.St
 	if err = addSetLegacyContextSigningOptionsMiddleware(stack); err != nil {
 		return err
 	}
 	if err = addTimeOffsetBuild(stack, c); err != nil {
 		return err
 	}
 	if err = addUserAgentRetryMode(stack, options); err != nil {
 		return err
 	}
@@ -149,6 +149,16 @@ func serviceAuthOptions(params *AuthResolverParameters) []*smithyauth.Option {
 				return props
 			}(),
 		},
 		{
 			SchemeID: smithyauth.SchemeIDSigV4A,
 			SignerProperties: func() smithy.Properties {
 				var props smithy.Properties
 				smithyhttp.SetSigV4ASigningName(&props, "sts")
 				smithyhttp.SetSigV4ASigningRegions(&props, []string{params.Region})
 				return props
 			}(),
 		},
 	}
 }
@@ -3,6 +3,7 @@
        "github.com/aws/aws-sdk-go-v2": "v1.4.0",
        "github.com/aws/aws-sdk-go-v2/internal/configsources": "v0.0.0-00010101000000-000000000000",
        "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2": "v2.0.0-00010101000000-000000000000",
        "github.com/aws/aws-sdk-go-v2/internal/v4a": "v0.0.0-00010101000000-000000000000",
        "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding": "v1.0.5",
        "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url": "v1.0.7",
        "github.com/aws/smithy-go": "v1.4.0"
@@ -3,4 +3,4 @@
 package sts
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.41.9"
+const goModuleVersion = "1.42.1"
@@ -4,9 +4,11 @@ package sts
 import (
 	"context"
 	"fmt"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	awsmiddleware "github.com/aws/aws-sdk-go-v2/aws/middleware"
 	internalauthsmithy "github.com/aws/aws-sdk-go-v2/internal/auth/smithy"
 	"github.com/aws/aws-sdk-go-v2/internal/v4a"
 	smithyauth "github.com/aws/smithy-go/auth"
 	"github.com/aws/smithy-go/logging"
 	"github.com/aws/smithy-go/metrics"
@@ -107,6 +109,9 @@ type Options struct {
 	// The client tracer provider.
 	TracerProvider tracing.TracerProvider
 	// Signature Version 4a (SigV4a) Signer
 	httpSignerV4a httpSignerV4a
 	// The initial DefaultsMode used when the client options were constructed. If the
 	// DefaultsMode was set to aws.DefaultsModeAuto this will store what the resolved
 	// value was at that point in time.
@@ -146,6 +151,9 @@ func (o Options) GetIdentityResolver(schemeID string) smithyauth.IdentityResolve
 	if schemeID == "aws.auth#sigv4" {
 		return getSigV4IdentityResolver(o)
 	}
 	if schemeID == "aws.auth#sigv4a" {
 		return getSigV4AIdentityResolver(o)
 	}
 	if schemeID == "smithy.api#noAuth" {
 		return &smithyauth.AnonymousIdentityResolver{}
 	}
@@ -231,6 +239,46 @@ func WithSigV4SigningRegion(region string) func(*Options) {
 	}
 }
 func getSigV4AIdentityResolver(o Options) smithyauth.IdentityResolver {
 	if o.Credentials != nil {
 		return &v4a.CredentialsProviderAdapter{
 			Provider: &v4a.SymmetricCredentialAdaptor{
 				SymmetricProvider: o.Credentials,
 			},
 		}
 	}
 	return nil
 }
 // WithSigV4ASigningRegions applies an override to the authentication workflow to
 // use the given signing region set for SigV4A-authenticated operations.
 //
 // This is an advanced setting. The value here is FINAL, taking precedence over
 // the resolved signing region set from both auth scheme resolution and endpoint
 // resolution.
 func WithSigV4ASigningRegions(regions []string) func(*Options) {
 	fn := func(ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler) (
 		out middleware.FinalizeOutput, metadata middleware.Metadata, err error,
 	) {
 		rscheme := getResolvedAuthScheme(ctx)
 		if rscheme == nil {
 			return out, metadata, fmt.Errorf("no resolved auth scheme")
 		}
 		smithyhttp.SetSigV4ASigningRegions(&rscheme.SignerProperties, regions)
 		return next.HandleFinalize(ctx, in)
 	}
 	return func(o *Options) {
 		o.APIOptions = append(o.APIOptions, func(s *middleware.Stack) error {
 			return s.Finalize.Insert(
 				middleware.FinalizeMiddlewareFunc("withSigV4ASigningRegions", fn),
 				"Signing",
 				middleware.Before,
 			)
 		})
 	}
 }
 func ignoreAnonymousAuth(options *Options) {
 	if aws.IsCredentialsProvider(options.Credentials, (*aws.AnonymousCredentials)(nil)) {
 		options.Credentials = nil
@@ -0,0 +1,172 @@
 # AGENTS.md
 ## Project overview
 smithy-go is the Go code generator and runtime for [Smithy](https://smithy.io/).
 It has two major components:
 1. **Codegen** (`codegen/`) — A Smithy build plugin written in Java that
   generates Go client/server/shape code from Smithy models.
 2. **Runtime** (`./`, top-level Go module) — The Go packages that generated
   code depends on at runtime.
 The primary downstream consumer is
 [aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2).
 ## Repository layout
 ```
 .                               # Root Go module (github.com/aws/smithy-go)
 ├── auth/                       # Auth identity + scheme interfaces
 │   └── bearer/                 # Bearer token auth
 ├── aws-http-auth/              # Separate module: AWS SigV4/SigV4A HTTP signing
 ├── codegen/                    # Java/Gradle: Smithy code generator
 │   ├── smithy-go-codegen/      # Main codegen source (Java)
 │   └── smithy-go-codegen-test/ # Codegen integration tests
 ├── container/                  # Generic container types
 ├── context/                    # Context helpers
 ├── document/                   # Smithy document type abstraction
 │   └── json/                   # JSON document codec
 ├── encoding/                   # Wire format encoders/decoders
 │   ├── cbor/                   # CBOR (used by rpcv2Cbor)
 │   ├── httpbinding/            # HTTP binding serde helpers
 │   ├── json/                   # JSON encoder/decoder
 │   └── xml/                    # XML encoder/decoder
 ├── endpoints/                  # Endpoint resolution types
 ├── internal/                   # Internal utilities (singleflight, etc.)
 ├── io/                         # I/O helpers
 ├── logging/                    # Logging interfaces
 ├── metrics/                    # Metrics interfaces
 │   └── smithyotelmetrics/      # Separate module: OpenTelemetry metrics adapter
 ├── middleware/                 # Middleware stack (the core of the operation pipeline)
 ├── ptr/                        # Pointer-to/from-value helpers
 ├── testing/                    # Test assertion helpers for generated protocol tests
 │   └── xml/                    # XML comparison utilities
 ├── time/                       # Smithy timestamp format helpers
 ├── tracing/                    # Tracing interfaces
 │   └── smithyoteltracing/      # Separate module: OpenTelemetry tracing adapter
 └── transport/
    └── http/                   # HTTP request/response types and middleware
 ```
 ## Building and testing
 ### Runtime (Go)
 ```bash
 # Run unit tests
 make unit
 ```
 ### Codegen (Java)
 ```bash
 # Build and test codegen
 cd codegen && ./gradlew build
 # Publish to local Maven for downstream use
 cd codegen && ./gradlew publishToMavenLocal
 ```
 The codegen artifact version is fixed at `0.1.0` and is not published to
 Maven Central — you **MUST** `publishToMavenLocal`.
 ## Runtime architecture
 ### Middleware stack
 The operation pipeline is built on a middleware stack defined in `middleware/`.
 Steps execute in order: Initialize → Serialize → Build → Finalize →
 Deserialize. Each step is a `middleware.Step` that holds an ordered list of
 middleware. The codegen generates middleware registrations for each operation.
 ### Encoding packages
 Each wire format has its own encoder/decoder under `encoding/`. These are
 low-level — they produce/consume raw tokens or values, not full Smithy shapes.
 Generated serde code calls into these packages.
 ## Codegen: GoWriter and template system
 GoWriter extends Smithy's `SymbolWriter` and is the primary mechanism for
 generating Go source. It has **two distinct writing styles** that must not be
 confused.
 ### Style 1: Positional args (`writer.write` / `writer.openBlock`)
 Inherited from `SymbolWriter`. Arguments are positional and referenced with
 `$`-prefixed format characters. Each `$X` consumes the next argument in order.
 Format characters:
 - `$L` — Literal (toString). Strings, names, anything that should be inserted
  verbatim.
 - `$S` — String, quoted. Wraps the value in Go double-quotes.
 - `$T` — Type (Symbol). Inserts the symbol name and auto-adds its import.
 - `$P` — Pointable type (Symbol). Like `$T` but prepends `*` if the symbol is
  marked pointable.
 - `$W` — Writable. Evaluates a `Writable` (lambda/closure) inline.
 - `$D` — Dependency. Adds a `GoDependency` import, expands to empty string.
 Numbered variants (`$1L`, `$2T`, etc.) allow reusing the same argument
 multiple times. The number is 1-indexed and refers to the position in the
 argument list:
 ```java
 // $1L is used twice, $2L once — only 2 args needed
 writer.write("type $1L struct{}\nvar _ $2L = (*$1L)(nil)",
    DEFAULT_NAME, INTERFACE_NAME);
 ```
 `openBlock`/`closeBlock` manage indentation for braced blocks. Arguments are
 positional:
 ```java
 writer.openBlock("func (c $P) $T(ctx $T) ($P, error) {", "}",
    serviceSymbol, operationSymbol, contextSymbol, outputSymbol,
    () -> {
        writer.write("return nil, nil");
    });
 ```
 ### Style 2: Named template args (`goTemplate` / `writeGoTemplate`)
 Uses `$name:X` syntax where `name` is a key in a `Map<String, Object>` and `X`
 is the format character. Arguments are passed as one or more maps. This is the
 **preferred style for new code** — it is more readable and less error-prone
 than positional args.
 ```java
 return goTemplate("""
    func $name:L(v $cborValue:T) ($type:T, error) {
        return $coercer:T(v)
    }
    """,
    Map.of(
        "name", getDeserializerName(shape),
        "cborValue", SmithyGoTypes.Encoding.Cbor.Value,
        "type", symbolProvider.toSymbol(shape),
        "coercer", coercer
    ));
 ```
 Rules:
 - `goTemplate(String, Map...)` is a **static** method that returns a
  `Writable` (a `Consumer<GoWriter>` lambda). It does NOT write immediately.
 - `writeGoTemplate(String, Map...)` is an **instance** method that writes
  immediately to the writer.
 - Maps are merged into the writer's context scope for the duration of the
  template. Multiple maps can be passed and are applied in order.
 - The writer pre-populates common symbols in context: `fmt.Sprintf`,
  `fmt.Errorf`, `errors.As`, `context.Context`, `time.Now`.
 ### Composing writables
 - `ChainWritable` — Collects multiple `Writable`s and composes them with
  newlines between each. Use `.compose()` (with newlines) or
  `.compose(false)` (without).
 ### Symbol constants
 For symbols, use `SmithyGoDependency.*.valueSymbol("Name")` or
 `SmithyGoDependency.*.pointableSymbol("Name")`.
@@ -1,8 +1,37 @@
-# Release (2026-02-27)
+# Release (2026-04-23)
 ## General Highlights
 * **Dependency Update**: Updated to the latest SDK module versions
 ## Module Highlights
 * `github.com/aws/smithy-go`: v1.25.1
  * **Bug Fix**: Fixed a memory leak in the LRU cache implementation used by some AWS services.
 # Release (2026-04-15)
 ## General Highlights
 * **Dependency Update**: Updated to the latest SDK module versions
 ## Module Highlights
 * `github.com/aws/smithy-go`: v1.25.0
  * **Feature**: Add support for endpointBdd trait
 # Release (2026-04-02)
 ## General Highlights
 * **Dependency Update**: Updated to the latest SDK module versions
 ## Module Highlights
 * `github.com/aws/smithy-go`: v1.24.3
  * **Bug Fix**: Add additional sigv4 configuration.
 * `github.com/aws/smithy-go/aws-http-auth`: [v1.1.3](aws-http-auth/CHANGELOG.md#v113-2026-04-02)
  * **Bug Fix**: Add additional sigv4 configuration.
 # Release (2026-02-27)
 ## General Highlights
 * **Dependency Update**: Bump minimum go version to 1.24.
 # Release (2026-02-20)
 ## General Highlights
@@ -0,0 +1,16 @@
 package rulesfn
 import "strings"
 // Split splits the input string by the delimiter and returns the resulting
 // parts. If limit is > 0, at most limit substrings are returned.
 // Returns a slice with a single empty string if the input is empty.
 func Split(input, delimiter string, limit int) []string {
 	if len(input) == 0 {
 		return []string{""}
 	}
 	if limit > 0 {
 		return strings.SplitN(input, delimiter, limit)
 	}
 	return strings.Split(input, delimiter)
 }
@@ -3,4 +3,4 @@
 package smithy
 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.24.2"
+const goModuleVersion = "1.25.1"
@@ -24,7 +24,7 @@ var (
 	Package = "github.com/containerd/containerd/v2"
 	// Version holds the complete version number. Filled in at linking time.
-	Version = "2.2.2+unknown"
+	Version = "2.2.3+unknown"
 	// Revision is filled with the VCS (e.g. git) revision being used to build
 	// the program at linking time.
@@ -22,8 +22,12 @@ var errBadPattern = errors.New("syntax error in pattern")
 //	term:
 //		'*'         matches any sequence of non-/ characters
 //		'?'         matches any single non-/ character
-//		'[' [ '^' ] { character-range } ']'
+//		'[' [ '!' ] { character-range } ']'
 //		            character class (must be non-empty)
 //
 // NOTE: Only '!' is supported for character class negation, not '^'. This is to
 // ensure compatibility with in-toto-python.
 //
 //		c           matches character c (c != '*', '?', '\\', '[')
 //		'\\' c      matches character c
 //
@@ -141,7 +145,7 @@ func matchChunk(chunk, s string) (rest string, ok bool, err error) {
 			chunk = chunk[1:]
 			// possibly negated
 			negated := false
-			if len(chunk) > 0 && chunk[0] == '^' {
+			if len(chunk) > 0 && chunk[0] == '!' {
 				negated = true
 				chunk = chunk[1:]
 			}
@@ -1,2 +1,3 @@
 * -text
 *.bin -text -diff
 *.md text eol=lf
@@ -1,79 +1,79 @@
-# Finite State Entropy
+# Finite State Entropy
-
+
-This package provides Finite State Entropy encoding and decoding.
+This package provides Finite State Entropy encoding and decoding.
-            
+            
-Finite State Entropy (also referenced as [tANS](https://en.wikipedia.org/wiki/Asymmetric_numeral_systems#tANS)) 
+Finite State Entropy (also referenced as [tANS](https://en.wikipedia.org/wiki/Asymmetric_numeral_systems#tANS)) 
-encoding provides a fast near-optimal symbol encoding/decoding
+encoding provides a fast near-optimal symbol encoding/decoding
-for byte blocks as implemented in [zstandard](https://github.com/facebook/zstd).
+for byte blocks as implemented in [zstandard](https://github.com/facebook/zstd).
-
+
-This can be used for compressing input with a lot of similar input values to the smallest number of bytes.
+This can be used for compressing input with a lot of similar input values to the smallest number of bytes.
-This does not perform any multi-byte [dictionary coding](https://en.wikipedia.org/wiki/Dictionary_coder) as LZ coders,
+This does not perform any multi-byte [dictionary coding](https://en.wikipedia.org/wiki/Dictionary_coder) as LZ coders,
-but it can be used as a secondary step to compressors (like Snappy) that does not do entropy encoding. 
+but it can be used as a secondary step to compressors (like Snappy) that does not do entropy encoding. 
-
+
-* [Godoc documentation](https://godoc.org/github.com/klauspost/compress/fse)
+* [Godoc documentation](https://godoc.org/github.com/klauspost/compress/fse)
-
+
-## News
+## News
-
+
- * Feb 2018: First implementation released. Consider this beta software for now.
+ * Feb 2018: First implementation released. Consider this beta software for now.
-
+
-# Usage
+# Usage
-
+
-This package provides a low level interface that allows to compress single independent blocks. 
+This package provides a low level interface that allows to compress single independent blocks. 
-
+
-Each block is separate, and there is no built in integrity checks. 
+Each block is separate, and there is no built in integrity checks. 
-This means that the caller should keep track of block sizes and also do checksums if needed.  
+This means that the caller should keep track of block sizes and also do checksums if needed.  
-
+
-Compressing a block is done via the [`Compress`](https://godoc.org/github.com/klauspost/compress/fse#Compress) function.
+Compressing a block is done via the [`Compress`](https://godoc.org/github.com/klauspost/compress/fse#Compress) function.
-You must provide input and will receive the output and maybe an error.
+You must provide input and will receive the output and maybe an error.
-
+
-These error values can be returned:
+These error values can be returned:
-
+
-| Error               | Description                                                                 |
+| Error               | Description                                                                 |
-|---------------------|-----------------------------------------------------------------------------|
+|---------------------|-----------------------------------------------------------------------------|
-| `<nil>`             | Everything ok, output is returned                                           |
+| `<nil>`             | Everything ok, output is returned                                           |
-| `ErrIncompressible` | Returned when input is judged to be too hard to compress                    |
+| `ErrIncompressible` | Returned when input is judged to be too hard to compress                    |
-| `ErrUseRLE`         | Returned from the compressor when the input is a single byte value repeated |
+| `ErrUseRLE`         | Returned from the compressor when the input is a single byte value repeated |
-| `(error)`           | An internal error occurred.                                                 |
+| `(error)`           | An internal error occurred.                                                 |
-
+
-As can be seen above there are errors that will be returned even under normal operation so it is important to handle these.
+As can be seen above there are errors that will be returned even under normal operation so it is important to handle these.
-
+
-To reduce allocations you can provide a [`Scratch`](https://godoc.org/github.com/klauspost/compress/fse#Scratch) object 
+To reduce allocations you can provide a [`Scratch`](https://godoc.org/github.com/klauspost/compress/fse#Scratch) object 
-that can be re-used for successive calls. Both compression and decompression accepts a `Scratch` object, and the same 
+that can be re-used for successive calls. Both compression and decompression accepts a `Scratch` object, and the same 
-object can be used for both.   
+object can be used for both.   
-
+
-Be aware, that when re-using a `Scratch` object that the *output* buffer is also re-used, so if you are still using this
+Be aware, that when re-using a `Scratch` object that the *output* buffer is also re-used, so if you are still using this
-you must set the `Out` field in the scratch to nil. The same buffer is used for compression and decompression output.
+you must set the `Out` field in the scratch to nil. The same buffer is used for compression and decompression output.
-
+
-Decompressing is done by calling the [`Decompress`](https://godoc.org/github.com/klauspost/compress/fse#Decompress) function.
+Decompressing is done by calling the [`Decompress`](https://godoc.org/github.com/klauspost/compress/fse#Decompress) function.
-You must provide the output from the compression stage, at exactly the size you got back. If you receive an error back
+You must provide the output from the compression stage, at exactly the size you got back. If you receive an error back
-your input was likely corrupted. 
+your input was likely corrupted. 
-
+
-It is important to note that a successful decoding does *not* mean your output matches your original input. 
+It is important to note that a successful decoding does *not* mean your output matches your original input. 
-There are no integrity checks, so relying on errors from the decompressor does not assure your data is valid.
+There are no integrity checks, so relying on errors from the decompressor does not assure your data is valid.
-
+
-For more detailed usage, see examples in the [godoc documentation](https://godoc.org/github.com/klauspost/compress/fse#pkg-examples).
+For more detailed usage, see examples in the [godoc documentation](https://godoc.org/github.com/klauspost/compress/fse#pkg-examples).
-
+
-# Performance
+# Performance
-
+
-A lot of factors are affecting speed. Block sizes and compressibility of the material are primary factors.  
+A lot of factors are affecting speed. Block sizes and compressibility of the material are primary factors.  
-All compression functions are currently only running on the calling goroutine so only one core will be used per block.  
+All compression functions are currently only running on the calling goroutine so only one core will be used per block.  
-
+
-The compressor is significantly faster if symbols are kept as small as possible. The highest byte value of the input
+The compressor is significantly faster if symbols are kept as small as possible. The highest byte value of the input
-is used to reduce some of the processing, so if all your input is above byte value 64 for instance, it may be 
+is used to reduce some of the processing, so if all your input is above byte value 64 for instance, it may be 
-beneficial to transpose all your input values down by 64.   
+beneficial to transpose all your input values down by 64.   
-
+
-With moderate block sizes around 64k speed are typically 200MB/s per core for compression and 
+With moderate block sizes around 64k speed are typically 200MB/s per core for compression and 
-around 300MB/s decompression speed. 
+around 300MB/s decompression speed. 
-
+
-The same hardware typically does Huffman (deflate) encoding at 125MB/s and decompression at 100MB/s. 
+The same hardware typically does Huffman (deflate) encoding at 125MB/s and decompression at 100MB/s. 
-
+
-# Plans
+# Plans
-
+
-At one point, more internals will be exposed to facilitate more "expert" usage of the components. 
+At one point, more internals will be exposed to facilitate more "expert" usage of the components. 
-
+
-A streaming interface is also likely to be implemented. Likely compatible with [FSE stream format](https://github.com/Cyan4973/FiniteStateEntropy/blob/dev/programs/fileio.c#L261).  
+A streaming interface is also likely to be implemented. Likely compatible with [FSE stream format](https://github.com/Cyan4973/FiniteStateEntropy/blob/dev/programs/fileio.c#L261).  
-
+
-# Contributing
+# Contributing
-
+
-Contributions are always welcome. Be aware that adding public functions will require good justification and breaking 
+Contributions are always welcome. Be aware that adding public functions will require good justification and breaking 
 changes will likely not be accepted. If in doubt open an issue before writing the PR.  
@@ -1,89 +1,89 @@
-# Huff0 entropy compression
+# Huff0 entropy compression
-
+
-This package provides Huff0 encoding and decoding as used in zstd.
+This package provides Huff0 encoding and decoding as used in zstd.
-            
+            
-[Huff0](https://github.com/Cyan4973/FiniteStateEntropy#new-generation-entropy-coders), 
+[Huff0](https://github.com/Cyan4973/FiniteStateEntropy#new-generation-entropy-coders), 
-a Huffman codec designed for modern CPU, featuring OoO (Out of Order) operations on multiple ALU 
+a Huffman codec designed for modern CPU, featuring OoO (Out of Order) operations on multiple ALU 
-(Arithmetic Logic Unit), achieving extremely fast compression and decompression speeds.
+(Arithmetic Logic Unit), achieving extremely fast compression and decompression speeds.
-
+
-This can be used for compressing input with a lot of similar input values to the smallest number of bytes.
+This can be used for compressing input with a lot of similar input values to the smallest number of bytes.
-This does not perform any multi-byte [dictionary coding](https://en.wikipedia.org/wiki/Dictionary_coder) as LZ coders,
+This does not perform any multi-byte [dictionary coding](https://en.wikipedia.org/wiki/Dictionary_coder) as LZ coders,
-but it can be used as a secondary step to compressors (like Snappy) that does not do entropy encoding. 
+but it can be used as a secondary step to compressors (like Snappy) that does not do entropy encoding. 
-
+
-* [Godoc documentation](https://godoc.org/github.com/klauspost/compress/huff0)
+* [Godoc documentation](https://godoc.org/github.com/klauspost/compress/huff0)
-
+
-## News
+## News
-
+
-This is used as part of the [zstandard](https://github.com/klauspost/compress/tree/master/zstd#zstd) compression and decompression package.
+This is used as part of the [zstandard](https://github.com/klauspost/compress/tree/master/zstd#zstd) compression and decompression package.
-
+
-This ensures that most functionality is well tested.
+This ensures that most functionality is well tested.
-
+
-# Usage
+# Usage
-
+
-This package provides a low level interface that allows to compress single independent blocks. 
+This package provides a low level interface that allows to compress single independent blocks. 
-
+
-Each block is separate, and there is no built in integrity checks. 
+Each block is separate, and there is no built in integrity checks. 
-This means that the caller should keep track of block sizes and also do checksums if needed.  
+This means that the caller should keep track of block sizes and also do checksums if needed.  
-
+
-Compressing a block is done via the [`Compress1X`](https://godoc.org/github.com/klauspost/compress/huff0#Compress1X) and 
+Compressing a block is done via the [`Compress1X`](https://godoc.org/github.com/klauspost/compress/huff0#Compress1X) and 
-[`Compress4X`](https://godoc.org/github.com/klauspost/compress/huff0#Compress4X) functions.
+[`Compress4X`](https://godoc.org/github.com/klauspost/compress/huff0#Compress4X) functions.
-You must provide input and will receive the output and maybe an error.
+You must provide input and will receive the output and maybe an error.
-
+
-These error values can be returned:
+These error values can be returned:
-
+
-| Error               | Description                                                                 |
+| Error               | Description                                                                 |
-|---------------------|-----------------------------------------------------------------------------|
+|---------------------|-----------------------------------------------------------------------------|
-| `<nil>`             | Everything ok, output is returned                                           |
+| `<nil>`             | Everything ok, output is returned                                           |
-| `ErrIncompressible` | Returned when input is judged to be too hard to compress                    |
+| `ErrIncompressible` | Returned when input is judged to be too hard to compress                    |
-| `ErrUseRLE`         | Returned from the compressor when the input is a single byte value repeated |
+| `ErrUseRLE`         | Returned from the compressor when the input is a single byte value repeated |
-| `ErrTooBig`         | Returned if the input block exceeds the maximum allowed size (128 Kib)      |
+| `ErrTooBig`         | Returned if the input block exceeds the maximum allowed size (128 Kib)      |
-| `(error)`           | An internal error occurred.                                                 |
+| `(error)`           | An internal error occurred.                                                 |
-
+
-
+
-As can be seen above some of there are errors that will be returned even under normal operation so it is important to handle these.
+As can be seen above some of there are errors that will be returned even under normal operation so it is important to handle these.
-
+
-To reduce allocations you can provide a [`Scratch`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch) object 
+To reduce allocations you can provide a [`Scratch`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch) object 
-that can be re-used for successive calls. Both compression and decompression accepts a `Scratch` object, and the same 
+that can be re-used for successive calls. Both compression and decompression accepts a `Scratch` object, and the same 
-object can be used for both.   
+object can be used for both.   
-
+
-Be aware, that when re-using a `Scratch` object that the *output* buffer is also re-used, so if you are still using this
+Be aware, that when re-using a `Scratch` object that the *output* buffer is also re-used, so if you are still using this
-you must set the `Out` field in the scratch to nil. The same buffer is used for compression and decompression output.
+you must set the `Out` field in the scratch to nil. The same buffer is used for compression and decompression output.
-
+
-The `Scratch` object will retain state that allows to re-use previous tables for encoding and decoding.  
+The `Scratch` object will retain state that allows to re-use previous tables for encoding and decoding.  
-
+
-## Tables and re-use
+## Tables and re-use
-
+
-Huff0 allows for reusing tables from the previous block to save space if that is expected to give better/faster results. 
+Huff0 allows for reusing tables from the previous block to save space if that is expected to give better/faster results. 
-
+
-The Scratch object allows you to set a [`ReusePolicy`](https://godoc.org/github.com/klauspost/compress/huff0#ReusePolicy) 
+The Scratch object allows you to set a [`ReusePolicy`](https://godoc.org/github.com/klauspost/compress/huff0#ReusePolicy) 
-that controls this behaviour. See the documentation for details. This can be altered between each block.
+that controls this behaviour. See the documentation for details. This can be altered between each block.
-
+
-Do however note that this information is *not* stored in the output block and it is up to the users of the package to
+Do however note that this information is *not* stored in the output block and it is up to the users of the package to
-record whether [`ReadTable`](https://godoc.org/github.com/klauspost/compress/huff0#ReadTable) should be called,
+record whether [`ReadTable`](https://godoc.org/github.com/klauspost/compress/huff0#ReadTable) should be called,
-based on the boolean reported back from the CompressXX call. 
+based on the boolean reported back from the CompressXX call. 
-
+
-If you want to store the table separate from the data, you can access them as `OutData` and `OutTable` on the 
+If you want to store the table separate from the data, you can access them as `OutData` and `OutTable` on the 
-[`Scratch`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch) object.
+[`Scratch`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch) object.
-
+
-## Decompressing
+## Decompressing
-
+
-The first part of decoding is to initialize the decoding table through [`ReadTable`](https://godoc.org/github.com/klauspost/compress/huff0#ReadTable).
+The first part of decoding is to initialize the decoding table through [`ReadTable`](https://godoc.org/github.com/klauspost/compress/huff0#ReadTable).
-This will initialize the decoding tables. 
+This will initialize the decoding tables. 
-You can supply the complete block to `ReadTable` and it will return the data part of the block 
+You can supply the complete block to `ReadTable` and it will return the data part of the block 
-which can be given to the decompressor. 
+which can be given to the decompressor. 
-
+
-Decompressing is done by calling the [`Decompress1X`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch.Decompress1X) 
+Decompressing is done by calling the [`Decompress1X`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch.Decompress1X) 
-or [`Decompress4X`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch.Decompress4X) function.
+or [`Decompress4X`](https://godoc.org/github.com/klauspost/compress/huff0#Scratch.Decompress4X) function.
-
+
-For concurrently decompressing content with a fixed table a stateless [`Decoder`](https://godoc.org/github.com/klauspost/compress/huff0#Decoder) can be requested which will remain correct as long as the scratch is unchanged. The capacity of the provided slice indicates the expected output size.
+For concurrently decompressing content with a fixed table a stateless [`Decoder`](https://godoc.org/github.com/klauspost/compress/huff0#Decoder) can be requested which will remain correct as long as the scratch is unchanged. The capacity of the provided slice indicates the expected output size.
-
+
-You must provide the output from the compression stage, at exactly the size you got back. If you receive an error back
+You must provide the output from the compression stage, at exactly the size you got back. If you receive an error back
-your input was likely corrupted. 
+your input was likely corrupted. 
-
+
-It is important to note that a successful decoding does *not* mean your output matches your original input. 
+It is important to note that a successful decoding does *not* mean your output matches your original input. 
-There are no integrity checks, so relying on errors from the decompressor does not assure your data is valid.
+There are no integrity checks, so relying on errors from the decompressor does not assure your data is valid.
-
+
-# Contributing
+# Contributing
-
+
-Contributions are always welcome. Be aware that adding public functions will require good justification and breaking 
+Contributions are always welcome. Be aware that adding public functions will require good justification and breaking 
-changes will likely not be accepted. If in doubt open an issue before writing the PR.
+changes will likely not be accepted. If in doubt open an issue before writing the PR.
@@ -409,6 +409,7 @@ type SolveRequest struct {
 	Exporters               []*Exporter               `protobuf:"bytes,13,rep,name=Exporters,proto3" json:"Exporters,omitempty"`
 	EnableSessionExporter   bool                      `protobuf:"varint,14,opt,name=EnableSessionExporter,proto3" json:"EnableSessionExporter,omitempty"`
 	SourcePolicySession     string                    `protobuf:"bytes,15,opt,name=SourcePolicySession,proto3" json:"SourcePolicySession,omitempty"`
 	CompatibilityVersion    int64                     `protobuf:"varint,16,opt,name=CompatibilityVersion,proto3" json:"CompatibilityVersion,omitempty"`
 	unknownFields           protoimpl.UnknownFields
 	sizeCache               protoimpl.SizeCache
 }
@@ -548,6 +549,13 @@ func (x *SolveRequest) GetSourcePolicySession() string {
 	return ""
 }
 func (x *SolveRequest) GetCompatibilityVersion() int64 {
 	if x != nil {
 		return x.CompatibilityVersion
 	}
 	return 0
 }
 type CacheOptions struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// ExportRefDeprecated is deprecated in favor or the new Exports since BuildKit v0.4.0.
@@ -2058,7 +2066,7 @@ const file_github_com_moby_buildkit_api_services_control_control_proto_rawDesc =
 	" \x01(\tR\n" +
 	"RecordType\x12\x16\n" +
 	"\x06Shared\x18\v \x01(\bR\x06Shared\x12\x18\n" +
-	"\aParents\x18\f \x03(\tR\aParents\"\xa6\b\n" +
+	"\aParents\x18\f \x03(\tR\aParents\"\xda\b\n" +
 	"\fSolveRequest\x12\x10\n" +
 	"\x03Ref\x18\x01 \x01(\tR\x03Ref\x12.\n" +
 	"\n" +
@@ -2077,7 +2085,8 @@ const file_github_com_moby_buildkit_api_services_control_control_proto_rawDesc =
 	"\fSourcePolicy\x18\f \x01(\v2%.moby.buildkit.v1.sourcepolicy.PolicyR\fSourcePolicy\x128\n" +
 	"\tExporters\x18\r \x03(\v2\x1a.moby.buildkit.v1.ExporterR\tExporters\x124\n" +
 	"\x15EnableSessionExporter\x18\x0e \x01(\bR\x15EnableSessionExporter\x120\n" +
-	"\x13SourcePolicySession\x18\x0f \x01(\tR\x13SourcePolicySession\x1aJ\n" +
+	"\x13SourcePolicySession\x18\x0f \x01(\tR\x13SourcePolicySession\x122\n" +
 	"\x14CompatibilityVersion\x18\x10 \x01(\x03R\x14CompatibilityVersion\x1aJ\n" +
 	"\x1cExporterAttrsDeprecatedEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
 	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a@\n" +
@@ -77,6 +77,7 @@ message SolveRequest {
 	repeated Exporter Exporters = 13;
 	bool EnableSessionExporter = 14;
 	string SourcePolicySession = 15;
 	int64 CompatibilityVersion = 16;
 }
 message CacheOptions {
@@ -143,6 +143,7 @@ func (m *SolveRequest) CloneVT() *SolveRequest {
 	r.SourcePolicy = m.SourcePolicy.CloneVT()
 	r.EnableSessionExporter = m.EnableSessionExporter
 	r.SourcePolicySession = m.SourcePolicySession
 	r.CompatibilityVersion = m.CompatibilityVersion
 	if rhs := m.ExporterAttrsDeprecated; rhs != nil {
 		tmpContainer := make(map[string]string, len(rhs))
 		for k, v := range rhs {
@@ -1043,6 +1044,9 @@ func (this *SolveRequest) EqualVT(that *SolveRequest) bool {
 	if this.SourcePolicySession != that.SourcePolicySession {
 		return false
 	}
 	if this.CompatibilityVersion != that.CompatibilityVersion {
 		return false
 	}
 	return string(this.unknownFields) == string(that.unknownFields)
 }
@@ -2249,6 +2253,13 @@ func (m *SolveRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 		i -= len(m.unknownFields)
 		copy(dAtA[i:], m.unknownFields)
 	}
 	if m.CompatibilityVersion != 0 {
 		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.CompatibilityVersion))
 		i--
 		dAtA[i] = 0x1
 		i--
 		dAtA[i] = 0x80
 	}
 	if len(m.SourcePolicySession) > 0 {
 		i -= len(m.SourcePolicySession)
 		copy(dAtA[i:], m.SourcePolicySession)
@@ -4174,6 +4185,9 @@ func (m *SolveRequest) SizeVT() (n int) {
 	if l > 0 {
 		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
 	}
 	if m.CompatibilityVersion != 0 {
 		n += 2 + protohelpers.SizeOfVarint(uint64(m.CompatibilityVersion))
 	}
 	n += len(m.unknownFields)
 	return n
 }
@@ -6326,6 +6340,25 @@ func (m *SolveRequest) UnmarshalVT(dAtA []byte) error {
 			}
 			m.SourcePolicySession = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
 		case 16:
 			if wireType != 0 {
 				return fmt.Errorf("proto: wrong wireType = %d for field CompatibilityVersion", wireType)
 			}
 			m.CompatibilityVersion = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return protohelpers.ErrIntOverflow
 				}
 				if iNdEx >= l {
 					return io.ErrUnexpectedEOF
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
 				m.CompatibilityVersion |= int64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
--- a/Show More
+++ b/Show More