vendor: update buildkit to v0.27.0-rc1

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2026-01-14 13:36:15 -08:00
parent 32b6b75478
commit d54f398c5d
116 changed files with 1980 additions and 711 deletions
@@ -29,11 +29,11 @@ require (
 	github.com/hashicorp/hcl/v2 v2.24.0
 	github.com/in-toto/in-toto-golang v0.9.0
 	github.com/mitchellh/hashstructure/v2 v2.0.2
-	github.com/moby/buildkit v0.26.1-0.20260106154623-ed6dc749ce40 // v0.27.0-dev
+	github.com/moby/buildkit v0.27.0-rc1
 	github.com/moby/go-archive v0.2.0
 	github.com/moby/moby/api v1.52.0
 	github.com/moby/moby/client v0.2.1
-	github.com/moby/policy-helpers v0.0.0-20251202162112-319fbb92a1cc
+	github.com/moby/policy-helpers v0.0.0-20251206004813-9fcc1a9ec5c9
 	github.com/moby/sys/atomicwriter v0.1.0
 	github.com/moby/sys/mountinfo v0.7.2
 	github.com/morikuni/aec v1.1.0
@@ -60,16 +60,16 @@ require (
 	go.opentelemetry.io/otel/sdk v1.38.0
 	go.opentelemetry.io/otel/trace v1.38.0
 	go.yaml.in/yaml/v3 v3.0.4
-	golang.org/x/crypto v0.45.0
-	golang.org/x/mod v0.30.0
-	golang.org/x/sync v0.18.0
-	golang.org/x/sys v0.38.0
-	golang.org/x/term v0.37.0
-	golang.org/x/text v0.31.0
+	golang.org/x/crypto v0.46.0
+	golang.org/x/mod v0.31.0
+	golang.org/x/sync v0.19.0
+	golang.org/x/sys v0.39.0
+	golang.org/x/term v0.38.0
+	golang.org/x/text v0.32.0
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20251103181224-f26f9409b101
 	google.golang.org/grpc v1.76.0
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1
-	google.golang.org/protobuf v1.36.10
+	google.golang.org/protobuf v1.36.11
 	k8s.io/api v0.34.1
 	k8s.io/apimachinery v0.34.1
 	k8s.io/client-go v0.34.1
@@ -225,11 +225,11 @@ require (
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.38.0 // indirect
 	go.opentelemetry.io/otel/sdk/metric v1.38.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.7.1 // indirect
-	go.yaml.in/yaml/v2 v2.4.2 // indirect
-	golang.org/x/net v0.47.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.3 // indirect
+	golang.org/x/net v0.48.0 // indirect
 	golang.org/x/oauth2 v0.33.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
-	golang.org/x/tools v0.38.0 // indirect
+	golang.org/x/tools v0.39.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20250929231259-57b25ae835d4 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
@@ -12,6 +12,8 @@ cloud.google.com/go/kms v1.23.2 h1:4IYDQL5hG4L+HzJBhzejUySoUOheh3Lk5YT4PCyyW6k=
 cloud.google.com/go/kms v1.23.2/go.mod h1:rZ5kK0I7Kn9W4erhYVoIRPtpizjunlrfU4fUkumUp8g=
 cloud.google.com/go/longrunning v0.6.7 h1:IGtfDWHhQCgCjwQjV9iiLnUta9LBCo8R9QmAFsS/PrE=
 cloud.google.com/go/longrunning v0.6.7/go.mod h1:EAFV3IZAKmM56TyiE6VAP3VoTzhZzySwI/YI1s/nRsY=
+cyphar.com/go-pathrs v0.2.1 h1:9nx1vOgwVvX1mNBWDu93+vaceedpbsDqo+XuBGL40b8=
+cyphar.com/go-pathrs v0.2.1/go.mod h1:y8f1EMG7r+hCuFf/rXsKqMJrJAUoADZGNh5/vZPKcGc=
 filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk=
@@ -46,8 +48,8 @@ github.com/agnivade/levenshtein v1.2.1 h1:EHBY3UOn1gwdy/VbFwgo4cxecRznFk7fKWN1KO
 github.com/agnivade/levenshtein v1.2.1/go.mod h1:QVVI16kDrtSuwcpd0p1+xMC6Z/VfhtCyDIjcwga4/DU=
 github.com/alessio/shellescape v1.4.1 h1:V7yhSDDn8LP4lc4jS8pFkt0zCnzVJlG5JXy9BVKJUX0=
 github.com/alessio/shellescape v1.4.1/go.mod h1:PZAiSCk0LJaZkiCSkPv8qIobYglO3FPpyFjDCtHLS30=
-github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092 h1:aM1rlcoLz8y5B2r4tTLMiVTrMtpfY0O8EScKJxaSaEc=
-github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092/go.mod h1:rYqSE9HbjzpHTI74vwPvae4ZVYZd1lue2ta6xHPdblA=
+github.com/anchore/go-struct-converter v0.1.0 h1:2rDRssAl6mgKBSLNiVCMADgZRhoqtw9dedlWa0OhD30=
+github.com/anchore/go-struct-converter v0.1.0/go.mod h1:rYqSE9HbjzpHTI74vwPvae4ZVYZd1lue2ta6xHPdblA=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883 h1:bvNMNQO63//z+xNgfBlViaCIJKLlCJ6/fmUseuG0wVQ=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/apparentlymart/go-cidr v1.0.1 h1:NmIwLZ/KdsjIUlhf+/Np40atNXm/+lZ5txfTJ/SpF+U=
@@ -126,8 +128,8 @@ github.com/containerd/fifo v1.1.0 h1:4I2mbh5stb1u6ycIABlBw9zgtlK8viPI9QkQNRQEEmY
 github.com/containerd/fifo v1.1.0/go.mod h1:bmC4NWMbXlt2EZ0Hc7Fx7QzTFxgPID13eH0Qu+MAb2o=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
-github.com/containerd/nydus-snapshotter v0.15.4 h1:l59kGRVMtwMLDLh322HsWhEsBCkRKMkGWYV5vBeLYCE=
-github.com/containerd/nydus-snapshotter v0.15.4/go.mod h1:eRJqnxQDr48HNop15kZdLZpFF5B6vf6Q11Aq1K0E4Ms=
+github.com/containerd/nydus-snapshotter v0.15.10 h1:hphjuKOqSHLGznNJiAvmsOWkdu4qFXjf4DzGrWSuIsM=
+github.com/containerd/nydus-snapshotter v0.15.10/go.mod h1:EWRd/QJ0b6UKHAqYgiV5gHlqLC2qq5cQiSlXEdVovrA=
 github.com/containerd/platforms v1.0.0-rc.2 h1:0SPgaNZPVWGEi4grZdV8VRYQn78y+nm6acgLGv/QzE4=
 github.com/containerd/platforms v1.0.0-rc.2/go.mod h1:J71L7B+aiM5SdIEqmd9wp6THLVRzJGXfNuWCZCllLA4=
 github.com/containerd/plugin v1.0.0 h1:c8Kf1TNl6+e2TtMHZt+39yAPDbouRH9WAToRjex483Y=
@@ -148,8 +150,8 @@ github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
 github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
 github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 h1:uX1JmpONuD549D73r6cgnxyUu18Zb7yHAy5AYU0Pm4Q=
 github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467/go.mod h1:uzvlm1mxhHkdfqitSA92i7Se+S9ksOn3a3qmv/kyOCw=
-github.com/cyphar/filepath-securejoin v0.5.1 h1:eYgfMq5yryL4fbWfkLpFFy2ukSELzaJOTaUTuh+oF48=
-github.com/cyphar/filepath-securejoin v0.5.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
+github.com/cyphar/filepath-securejoin v0.6.0 h1:BtGB77njd6SVO6VztOHfPxKitJvd/VPT+OFBFMOi1Is=
+github.com/cyphar/filepath-securejoin v0.6.0/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc=
 github.com/danieljoos/wincred v1.2.3 h1:v7dZC2x32Ut3nEfRH+vhoZGvN72+dQ/snVXo/vMFLdQ=
 github.com/danieljoos/wincred v1.2.3/go.mod h1:6qqX0WNrS4RzPZ1tnroDzq9kY3fu1KwE7MRLQK4X0bs=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -417,8 +419,8 @@ github.com/mitchellh/hashstructure/v2 v2.0.2 h1:vGKWl0YJqUNxE8d+h8f6NJLcCJrgbhC4
 github.com/mitchellh/hashstructure/v2 v2.0.2/go.mod h1:MG3aRVU/N29oo/V/IhBX8GR/zz4kQkprJgF2EVszyDE=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/moby/buildkit v0.26.1-0.20260106154623-ed6dc749ce40 h1:h45o8dTo7Cq1Su49bs9VHP83Fdp3olgMfgo3tZULXUw=
-github.com/moby/buildkit v0.26.1-0.20260106154623-ed6dc749ce40/go.mod h1:LtUhyzVLAD0ilniDZRbghEyRq9CgZAY7ywMXlVo9MBI=
+github.com/moby/buildkit v0.27.0-rc1 h1:fx00HQLMcNsLI1r7jp3Iak5Vq7u2XRtm0CjZhm+dwXs=
+github.com/moby/buildkit v0.27.0-rc1/go.mod h1:cBvE7XY7KqQPvhmuhLsCHE148bo0x3Hxq263d7xHsME=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/go-archive v0.2.0 h1:zg5QDUM2mi0JIM9fdQZWC7U8+2ZfixfTYoHL7rWUcP8=
@@ -431,8 +433,8 @@ github.com/moby/moby/client v0.2.1 h1:1Grh1552mvv6i+sYOdY+xKKVTvzJegcVMhuXocyDz/
 github.com/moby/moby/client v0.2.1/go.mod h1:O+/tw5d4a1Ha/ZA/tPxIZJapJRUS6LNZ1wiVRxYHyUE=
 github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk=
 github.com/moby/patternmatcher v0.6.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
-github.com/moby/policy-helpers v0.0.0-20251202162112-319fbb92a1cc h1:7mtGaK6NXYZzwXXEE9XOfdl5yTW3g47gApYMnJ385xY=
-github.com/moby/policy-helpers v0.0.0-20251202162112-319fbb92a1cc/go.mod h1:A00uXsOgzmvJRyrqH49Pl85on2e7/GItNuYLUxpzsgc=
+github.com/moby/policy-helpers v0.0.0-20251206004813-9fcc1a9ec5c9 h1:SISQT6l9QO+JGSTJ8QN0yWCueiSgfTStSU9KT+p537M=
+github.com/moby/policy-helpers v0.0.0-20251206004813-9fcc1a9ec5c9/go.mod h1:nJ1clNCIXZqUu3jxCkaUBpeR5bKyzzb7wmEG4xhecTI=
 github.com/moby/spdystream v0.5.0 h1:7r0J1Si3QO/kjRitvSLVVFUjxMEb/YLj6S9FF62JBCU=
 github.com/moby/spdystream v0.5.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
 github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
@@ -547,8 +549,8 @@ github.com/sigstore/timestamp-authority/v2 v2.0.2 h1:WavlEeLh6HKt+osbmsHDg6/FaM/
 github.com/sigstore/timestamp-authority/v2 v2.0.2/go.mod h1:D+wbQg8ASQzKnwBhLo7rIJD+9Zev4Ppqd4myPe8k57E=
 github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af h1:Sp5TG9f7K39yfB+If0vjp97vuT74F72r8hfRpP8jLU0=
 github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/spdx/tools-golang v0.5.5 h1:61c0KLfAcNqAjlg6UNMdkwpMernhw3zVRwDZ2x9XOmk=
-github.com/spdx/tools-golang v0.5.5/go.mod h1:MVIsXx8ZZzaRWNQpUDhC4Dud34edUYJYecciXgrw5vE=
+github.com/spdx/tools-golang v0.5.7 h1:+sWcKGnhwp3vLdMqPcLdA6QK679vd86cK9hQWH3AwCg=
+github.com/spdx/tools-golang v0.5.7/go.mod h1:jg7w0LOpoNAw6OxKEzCoqPC2GCTj45LyTlVmXubDsYw=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
 github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
@@ -663,56 +665,56 @@ go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
-go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
-go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
+go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
-golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
+golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
+golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
 golang.org/x/exp v0.0.0-20250911091902-df9299821621 h1:2id6c1/gto0kaHYyrixvknJ8tUK/Qs5IsmBtrc+FtgU=
 golang.org/x/exp v0.0.0-20250911091902-df9299821621/go.mod h1:TwQYMMnGpvZyc+JpB/UAuTNIsVJifOlSkrZkhcvpVUk=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.30.0 h1:fDEXFVZ/fmCKProc/yAXXUijritrDzahmwwefnjoPFk=
-golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc=
+golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI=
+golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
-golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
+golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
+golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
 golang.org/x/oauth2 v0.33.0 h1:4Q+qn+E5z8gPRJfmRy7C2gGG3T4jIprK6aSYgTXGRpo=
 golang.org/x/oauth2 v0.33.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I=
-golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
-golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
-golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
+golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
+golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.38.0 h1:PQ5pkm/rLO6HnxFR7N2lJHOZX6Kez5Y1gDSJla6jo7Q=
+golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
-golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
+golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
+golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
 golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
-golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
+golang.org/x/tools v0.39.0 h1:ik4ho21kwuQln40uelmciQPp9SipgNDdrafrYA4TmQQ=
+golang.org/x/tools v0.39.0/go.mod h1:JnefbkDPyD8UU2kI5fuf8ZX4/yUeh9W877ZeBONxUqQ=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -731,8 +733,8 @@ google.golang.org/grpc v1.76.0 h1:UnVkv1+uMLYXoIz6o7chp59WfQUYA2ex/BXQ9rHZu7A=
 google.golang.org/grpc v1.76.0/go.mod h1:Ju12QI8M6iQJtbcsV+awF5a4hfJMLi4X0JLo94ULZ6c=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 h1:F29+wU6Ee6qgu9TddPgooOdaqsxTMunOoj8KA5yuS5A=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1/go.mod h1:5KF+wpkbTSbGcR9zteSqZV6fqFOWBl4Yde8En8MryZA=
-google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
-google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        v3.11.4
 // source: github.com/moby/buildkit/api/services/control/control.proto

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        v3.11.4
 // source: github.com/moby/buildkit/api/types/worker.proto

@@ -0,0 +1,23 @@
+package ghatypes
+
+import "github.com/sigstore/sigstore-go/pkg/fulcio/certificate"
+
+type CacheConfig struct {
+	Sign   *SignConfig  `toml:"sign"`
+	Verify VerifyConfig `toml:"verify"`
+}
+
+type SignConfig struct {
+	Command []string `toml:"command"`
+}
+
+type VerifyConfig struct {
+	Required bool         `toml:"required"`
+	Policy   VerifyPolicy `toml:"policy"`
+}
+
+type VerifyPolicy struct {
+	TimestampThreshold int `toml:"timestampThreshold"`
+	TlogThreshold      int `toml:"tlogThreshold"`
+	certificate.Summary
+}
@@ -178,6 +178,36 @@ func (g *gatewayClientForBuild) ReleaseContainer(ctx context.Context, in *gatewa
 	return g.gateway.ReleaseContainer(ctx, in, opts...)
 }

+func (g *gatewayClientForBuild) ReadFileContainer(ctx context.Context, in *gatewayapi.ReadFileRequest, opts ...grpc.CallOption) (*gatewayapi.ReadFileResponse, error) {
+	if g.caps != nil {
+		if err := g.caps.Supports(gatewayapi.CapGatewayExecFilesystem); err != nil {
+			return nil, err
+		}
+	}
+	ctx = buildid.AppendToOutgoingContext(ctx, g.buildID)
+	return g.gateway.ReadFileContainer(ctx, in, opts...)
+}
+
+func (g *gatewayClientForBuild) ReadDirContainer(ctx context.Context, in *gatewayapi.ReadDirRequest, opts ...grpc.CallOption) (*gatewayapi.ReadDirResponse, error) {
+	if g.caps != nil {
+		if err := g.caps.Supports(gatewayapi.CapGatewayExecFilesystem); err != nil {
+			return nil, err
+		}
+	}
+	ctx = buildid.AppendToOutgoingContext(ctx, g.buildID)
+	return g.gateway.ReadDirContainer(ctx, in, opts...)
+}
+
+func (g *gatewayClientForBuild) StatFileContainer(ctx context.Context, in *gatewayapi.StatFileRequest, opts ...grpc.CallOption) (*gatewayapi.StatFileResponse, error) {
+	if g.caps != nil {
+		if err := g.caps.Supports(gatewayapi.CapGatewayExecFilesystem); err != nil {
+			return nil, err
+		}
+	}
+	ctx = buildid.AppendToOutgoingContext(ctx, g.buildID)
+	return g.gateway.StatFileContainer(ctx, in, opts...)
+}
+
 func (g *gatewayClientForBuild) ExecProcess(ctx context.Context, opts ...grpc.CallOption) (gatewayapi.LLBBridge_ExecProcessClient, error) {
 	if g.caps != nil {
 		if err := g.caps.Supports(gatewayapi.CapGatewayExec); err != nil {
@@ -1,6 +1,7 @@
 package config

 import (
+	"github.com/moby/buildkit/cache/remotecache/gha/ghatypes"
 	resolverconfig "github.com/moby/buildkit/util/resolver/config"
 )

@@ -46,6 +47,12 @@ type Config struct {
 	// ProvenanceEnvDir is the directory where extra config is loaded
 	// that is added to the provenance of builds. Defaults to /etc/buildkit/provenance.d/ ,
 	ProvenanceEnvDir string `toml:"provenanceEnvDir"`
+
+	Cache CacheConfig `toml:"cache"`
+}
+
+type CacheConfig struct {
+	GHA *ghatypes.CacheConfig `toml:"gha"`
 }

 type SystemConfig struct {
@@ -57,7 +57,6 @@ type SysMemoryStat struct {
 }

 type SysSample struct {
-	//nolint
 	Timestamp_     time.Time      `json:"timestamp"`
 	CPUStat        *SysCPUStat    `json:"cpuStat,omitempty"`
 	ProcStat       *ProcStat      `json:"procStat,omitempty"`
@@ -20,7 +20,6 @@ type Samples struct {

 // Sample represents a wrapper for sampled data of cgroupv2 controllers
 type Sample struct {
-	//nolint
 	Timestamp_ time.Time      `json:"timestamp"`
 	CPUStat    *CPUStat       `json:"cpuStat,omitempty"`
 	MemoryStat *MemoryStat    `json:"memoryStat,omitempty"`
@@ -163,7 +163,6 @@ var (
 		Format: func(cmd, file string) string {
 			return fmt.Sprintf("Attempting to %s file %q that is excluded by .dockerignore", cmd, file)
 		},
-		Experimental: true,
 	}
 	RuleInvalidDefinitionDescription = LinterRule[func(string, string) string]{
 		Name:        "InvalidDefinitionDescription",
@@ -49,25 +49,29 @@ func (node *Node) Location() []Range {
 // Dump dumps the AST defined by `node` as a list of sexps.
 // Returns a string suitable for printing.
 func (node *Node) Dump() string {
-	str := strings.ToLower(node.Value)
+	var str strings.Builder
+	str.WriteString(strings.ToLower(node.Value))

 	if len(node.Flags) > 0 {
-		str += fmt.Sprintf(" %q", node.Flags)
+		fmt.Fprintf(&str, " %q", node.Flags)
 	}

 	for _, n := range node.Children {
-		str += "(" + n.Dump() + ")\n"
+		str.WriteByte('(')
+		str.WriteString(n.Dump())
+		str.WriteString(")\n")
 	}

 	for n := node.Next; n != nil; n = n.Next {
+		str.WriteByte(' ')
 		if len(n.Children) > 0 {
-			str += " " + n.Dump()
+			str.WriteString(n.Dump())
 		} else {
-			str += " " + strconv.Quote(n.Value)
+			str.WriteString(strconv.Quote(n.Value))
 		}
 	}

-	return strings.TrimSpace(str)
+	return strings.TrimSpace(str.String())
 }

 func (node *Node) lines(start, end int) {
@@ -367,6 +371,8 @@ func Parse(rwc io.Reader) (*Result, error) {
 			for _, heredoc := range heredocs {
 				terminator := []byte(heredoc.Name)
 				terminated := false
+				var content strings.Builder
+				content.WriteString(heredoc.Content)
 				for scanner.Scan() {
 					bytesRead := scanner.Bytes()
 					currentLine++
@@ -379,12 +385,13 @@ func Parse(rwc io.Reader) (*Result, error) {
 						terminated = true
 						break
 					}
-					heredoc.Content += string(bytesRead)
+					content.Write(bytesRead)
 				}
 				if !terminated {
 					return nil, withLocation(errors.New("unterminated heredoc"), startLine, currentLine)
 				}

+				heredoc.Content = content.String()
 				child.Heredocs = append(child.Heredocs, heredoc)
 			}
 		}
@@ -34,7 +34,6 @@ func (bc *Client) Build(ctx context.Context, fn BuildFunc) (*ResultBuilder, erro
 	eg, ctx := errgroup.WithContext(ctx)

 	for i, tp := range targets {
-		i, tp := i, tp
 		eg.Go(func() error {
 			ref, img, baseImg, err := fn(ctx, tp, i)
 			if err != nil {
@@ -66,6 +66,9 @@ type Mount struct {
 type Container interface {
 	Start(context.Context, StartRequest) (ContainerProcess, error)
 	Release(context.Context) error
+	ReadFile(ctx context.Context, req ReadContainerRequest) ([]byte, error)
+	StatFile(ctx context.Context, req StatContainerRequest) (*fstypes.Stat, error)
+	ReadDir(ctx context.Context, req ReadDirContainerRequest) ([]*fstypes.Stat, error)
 }

 // StartRequest encapsulates the arguments to define a process within a
@@ -111,6 +114,11 @@ type ReadRequest struct {
 	Range    *FileRange
 }

+type ReadContainerRequest struct {
+	ReadRequest
+	MountIndex int
+}
+
 type FileRange struct {
 	Offset int
 	Length int
@@ -121,10 +129,20 @@ type ReadDirRequest struct {
 	IncludePattern string
 }

+type ReadDirContainerRequest struct {
+	ReadDirRequest
+	MountIndex int
+}
+
 type StatRequest struct {
 	Path string
 }

+type StatContainerRequest struct {
+	StatRequest
+	MountIndex int
+}
+
 // SolveRequest is same as frontend.SolveRequest but avoiding dependency
 type SolveRequest struct {
 	Evaluate       bool
@@ -1193,6 +1193,70 @@ func (ctr *container) Release(ctx context.Context) error {
 	return err
 }

+func (ctr *container) ReadFile(ctx context.Context, req client.ReadContainerRequest) ([]byte, error) {
+	if err := ctr.caps.Supports(pb.CapGatewayExecFilesystem); err != nil {
+		return nil, err
+	}
+
+	bklog.G(ctx).Debugf("|---> ReadFileContainer %s@%d", ctr.id, req.MountIndex)
+	in := &pb.ReadFileRequest{
+		Ref:        ctr.id,
+		FilePath:   req.Filename,
+		MountIndex: int32(req.MountIndex),
+	}
+	if req.Range != nil {
+		in.Range = &pb.FileRange{
+			Length: int64(req.Range.Length),
+			Offset: int64(req.Range.Offset),
+		}
+	}
+
+	resp, err := ctr.client.ReadFileContainer(ctx, in)
+	if err != nil {
+		return nil, err
+	}
+	return resp.Data, nil
+}
+
+func (ctr *container) ReadDir(ctx context.Context, req client.ReadDirContainerRequest) ([]*fstypes.Stat, error) {
+	if err := ctr.caps.Supports(pb.CapGatewayExecFilesystem); err != nil {
+		return nil, err
+	}
+
+	bklog.G(ctx).Debugf("|---> ReadDirContainer %s@%d", ctr.id, req.MountIndex)
+	in := &pb.ReadDirRequest{
+		Ref:            ctr.id,
+		DirPath:        req.Path,
+		IncludePattern: req.IncludePattern,
+		MountIndex:     int32(req.MountIndex),
+	}
+
+	resp, err := ctr.client.ReadDirContainer(ctx, in)
+	if err != nil {
+		return nil, err
+	}
+	return resp.Entries, nil
+}
+
+func (ctr *container) StatFile(ctx context.Context, req client.StatContainerRequest) (*fstypes.Stat, error) {
+	if err := ctr.caps.Supports(pb.CapGatewayExecFilesystem); err != nil {
+		return nil, err
+	}
+
+	bklog.G(ctx).Debugf("|---> StatFileContainer %s@%d", ctr.id, req.MountIndex)
+	in := &pb.StatFileRequest{
+		Ref:        ctr.id,
+		Path:       req.Path,
+		MountIndex: int32(req.MountIndex),
+	}
+
+	resp, err := ctr.client.StatFileContainer(ctx, in)
+	if err != nil {
+		return nil, err
+	}
+	return resp.Stat, nil
+}
+
 type containerProcess struct {
 	execMsgs *messageForwarder
 	id       string
@@ -1,4 +1,4 @@
-package moby_buildkit_v1_frontend //nolint:revive,staticcheck
+package moby_buildkit_v1_frontend //nolint:staticcheck

 import "github.com/moby/buildkit/util/apicaps"

@@ -52,6 +52,10 @@ const (
 	// created via gateway exec.
 	CapGatewayExecSignals apicaps.CapID = "gateway.exec.signals"

+	// CapGatewayExecFilesystem is the capability to interact with the filesystem for
+	// containers directly through the gateway.
+	CapGatewayExecFilesystem apicaps.CapID = "gateway.exec.filesystem"
+
 	// CapFrontendCaps can be used to check that frontends define support for certain capabilities
 	CapFrontendCaps apicaps.CapID = "frontend.caps"

@@ -201,6 +205,13 @@ func init() {
 		Status:  apicaps.CapStatusExperimental,
 	})

+	Caps.Init(apicaps.Cap{
+		ID:      CapGatewayExecFilesystem,
+		Name:    "gateway exec filesystem",
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
 	Caps.Init(apicaps.Cap{
 		ID:      CapFrontendCaps,
 		Name:    "frontend capabilities",
@@ -1,4 +1,4 @@
-package moby_buildkit_v1_frontend //nolint:revive,staticcheck
+package moby_buildkit_v1_frontend //nolint:staticcheck

 import (
 	"fmt"
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        v3.11.4
 // source: github.com/moby/buildkit/frontend/gateway/pb/gateway.proto

@@ -1678,6 +1678,7 @@ type ReadFileRequest struct {
 	Ref           string                 `protobuf:"bytes,1,opt,name=Ref,proto3" json:"Ref,omitempty"`
 	FilePath      string                 `protobuf:"bytes,2,opt,name=FilePath,proto3" json:"FilePath,omitempty"`
 	Range         *FileRange             `protobuf:"bytes,3,opt,name=Range,proto3" json:"Range,omitempty"`
+	MountIndex    int32                  `protobuf:"varint,4,opt,name=MountIndex,proto3" json:"MountIndex,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -1733,6 +1734,13 @@ func (x *ReadFileRequest) GetRange() *FileRange {
 	return nil
 }

+func (x *ReadFileRequest) GetMountIndex() int32 {
+	if x != nil {
+		return x.MountIndex
+	}
+	return 0
+}
+
 type FileRange struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Offset        int64                  `protobuf:"varint,1,opt,name=Offset,proto3" json:"Offset,omitempty"`
@@ -1834,6 +1842,7 @@ type ReadDirRequest struct {
 	Ref            string                 `protobuf:"bytes,1,opt,name=Ref,proto3" json:"Ref,omitempty"`
 	DirPath        string                 `protobuf:"bytes,2,opt,name=DirPath,proto3" json:"DirPath,omitempty"`
 	IncludePattern string                 `protobuf:"bytes,3,opt,name=IncludePattern,proto3" json:"IncludePattern,omitempty"`
+	MountIndex     int32                  `protobuf:"varint,4,opt,name=MountIndex,proto3" json:"MountIndex,omitempty"`
 	unknownFields  protoimpl.UnknownFields
 	sizeCache      protoimpl.SizeCache
 }
@@ -1889,6 +1898,13 @@ func (x *ReadDirRequest) GetIncludePattern() string {
 	return ""
 }

+func (x *ReadDirRequest) GetMountIndex() int32 {
+	if x != nil {
+		return x.MountIndex
+	}
+	return 0
+}
+
 type ReadDirResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Entries       []*types.Stat          `protobuf:"bytes,1,rep,name=entries,proto3" json:"entries,omitempty"`
@@ -1937,6 +1953,7 @@ type StatFileRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Ref           string                 `protobuf:"bytes,1,opt,name=Ref,proto3" json:"Ref,omitempty"`
 	Path          string                 `protobuf:"bytes,2,opt,name=Path,proto3" json:"Path,omitempty"`
+	MountIndex    int32                  `protobuf:"varint,3,opt,name=MountIndex,proto3" json:"MountIndex,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -1985,6 +2002,13 @@ func (x *StatFileRequest) GetPath() string {
 	return ""
 }

+func (x *StatFileRequest) GetMountIndex() int32 {
+	if x != nil {
+		return x.MountIndex
+	}
+	return 0
+}
+
 type StatFileResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Stat          *types.Stat            `protobuf:"bytes,1,opt,name=stat,proto3" json:"stat,omitempty"`
@@ -3354,25 +3378,34 @@ const file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDesc =
 	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\\\n" +
 	"\rSolveResponse\x12\x10\n" +
 	"\x03ref\x18\x01 \x01(\tR\x03ref\x129\n" +
-	"\x06result\x18\x03 \x01(\v2!.moby.buildkit.v1.frontend.ResultR\x06result\"{\n" +
+	"\x06result\x18\x03 \x01(\v2!.moby.buildkit.v1.frontend.ResultR\x06result\"\x9b\x01\n" +
 	"\x0fReadFileRequest\x12\x10\n" +
 	"\x03Ref\x18\x01 \x01(\tR\x03Ref\x12\x1a\n" +
 	"\bFilePath\x18\x02 \x01(\tR\bFilePath\x12:\n" +
-	"\x05Range\x18\x03 \x01(\v2$.moby.buildkit.v1.frontend.FileRangeR\x05Range\";\n" +
+	"\x05Range\x18\x03 \x01(\v2$.moby.buildkit.v1.frontend.FileRangeR\x05Range\x12\x1e\n" +
+	"\n" +
+	"MountIndex\x18\x04 \x01(\x05R\n" +
+	"MountIndex\";\n" +
 	"\tFileRange\x12\x16\n" +
 	"\x06Offset\x18\x01 \x01(\x03R\x06Offset\x12\x16\n" +
 	"\x06Length\x18\x02 \x01(\x03R\x06Length\"&\n" +
 	"\x10ReadFileResponse\x12\x12\n" +
-	"\x04Data\x18\x01 \x01(\fR\x04Data\"d\n" +
+	"\x04Data\x18\x01 \x01(\fR\x04Data\"\x84\x01\n" +
 	"\x0eReadDirRequest\x12\x10\n" +
 	"\x03Ref\x18\x01 \x01(\tR\x03Ref\x12\x18\n" +
 	"\aDirPath\x18\x02 \x01(\tR\aDirPath\x12&\n" +
-	"\x0eIncludePattern\x18\x03 \x01(\tR\x0eIncludePattern\"?\n" +
+	"\x0eIncludePattern\x18\x03 \x01(\tR\x0eIncludePattern\x12\x1e\n" +
+	"\n" +
+	"MountIndex\x18\x04 \x01(\x05R\n" +
+	"MountIndex\"?\n" +
 	"\x0fReadDirResponse\x12,\n" +
-	"\aentries\x18\x01 \x03(\v2\x12.fsutil.types.StatR\aentries\"7\n" +
+	"\aentries\x18\x01 \x03(\v2\x12.fsutil.types.StatR\aentries\"W\n" +
 	"\x0fStatFileRequest\x12\x10\n" +
 	"\x03Ref\x18\x01 \x01(\tR\x03Ref\x12\x12\n" +
-	"\x04Path\x18\x02 \x01(\tR\x04Path\":\n" +
+	"\x04Path\x18\x02 \x01(\tR\x04Path\x12\x1e\n" +
+	"\n" +
+	"MountIndex\x18\x03 \x01(\x05R\n" +
+	"MountIndex\":\n" +
 	"\x10StatFileResponse\x12&\n" +
 	"\x04stat\x18\x01 \x01(\v2\x12.fsutil.types.StatR\x04stat\"#\n" +
 	"\x0fEvaluateRequest\x12\x10\n" +
@@ -3460,7 +3493,7 @@ const file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDesc =
 	"\x06Bundle\x10\x01*&\n" +
 	"\x11InTotoSubjectKind\x12\b\n" +
 	"\x04Self\x10\x00\x12\a\n" +
-	"\x03Raw\x10\x012\xbd\v\n" +
+	"\x03Raw\x10\x012\x84\x0e\n" +
 	"\tLLBBridge\x12\x81\x01\n" +
 	"\x12ResolveImageConfig\x124.moby.buildkit.v1.frontend.ResolveImageConfigRequest\x1a5.moby.buildkit.v1.frontend.ResolveImageConfigResponse\x12~\n" +
 	"\x11ResolveSourceMeta\x123.moby.buildkit.v1.frontend.ResolveSourceMetaRequest\x1a4.moby.buildkit.v1.frontend.ResolveSourceMetaResponse\x12Z\n" +
@@ -3474,7 +3507,10 @@ const file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDesc =
 	"\x06Inputs\x12(.moby.buildkit.v1.frontend.InputsRequest\x1a).moby.buildkit.v1.frontend.InputsResponse\x12o\n" +
 	"\fNewContainer\x12..moby.buildkit.v1.frontend.NewContainerRequest\x1a/.moby.buildkit.v1.frontend.NewContainerResponse\x12{\n" +
 	"\x10ReleaseContainer\x122.moby.buildkit.v1.frontend.ReleaseContainerRequest\x1a3.moby.buildkit.v1.frontend.ReleaseContainerResponse\x12a\n" +
-	"\vExecProcess\x12&.moby.buildkit.v1.frontend.ExecMessage\x1a&.moby.buildkit.v1.frontend.ExecMessage(\x010\x01\x12W\n" +
+	"\vExecProcess\x12&.moby.buildkit.v1.frontend.ExecMessage\x1a&.moby.buildkit.v1.frontend.ExecMessage(\x010\x01\x12l\n" +
+	"\x11ReadFileContainer\x12*.moby.buildkit.v1.frontend.ReadFileRequest\x1a+.moby.buildkit.v1.frontend.ReadFileResponse\x12i\n" +
+	"\x10ReadDirContainer\x12).moby.buildkit.v1.frontend.ReadDirRequest\x1a*.moby.buildkit.v1.frontend.ReadDirResponse\x12l\n" +
+	"\x11StatFileContainer\x12*.moby.buildkit.v1.frontend.StatFileRequest\x1a+.moby.buildkit.v1.frontend.StatFileResponse\x12W\n" +
 	"\x04Warn\x12&.moby.buildkit.v1.frontend.WarnRequest\x1a'.moby.buildkit.v1.frontend.WarnResponseBHZFgithub.com/moby/buildkit/frontend/gateway/pb;moby_buildkit_v1_frontendb\x06proto3"

 var (
@@ -3658,23 +3694,29 @@ var file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_depIdxs = []
 	39, // 79: moby.buildkit.v1.frontend.LLBBridge.NewContainer:input_type -> moby.buildkit.v1.frontend.NewContainerRequest
 	41, // 80: moby.buildkit.v1.frontend.LLBBridge.ReleaseContainer:input_type -> moby.buildkit.v1.frontend.ReleaseContainerRequest
 	43, // 81: moby.buildkit.v1.frontend.LLBBridge.ExecProcess:input_type -> moby.buildkit.v1.frontend.ExecMessage
-	37, // 82: moby.buildkit.v1.frontend.LLBBridge.Warn:input_type -> moby.buildkit.v1.frontend.WarnRequest
-	14, // 83: moby.buildkit.v1.frontend.LLBBridge.ResolveImageConfig:output_type -> moby.buildkit.v1.frontend.ResolveImageConfigResponse
-	16, // 84: moby.buildkit.v1.frontend.LLBBridge.ResolveSourceMeta:output_type -> moby.buildkit.v1.frontend.ResolveSourceMetaResponse
-	25, // 85: moby.buildkit.v1.frontend.LLBBridge.Solve:output_type -> moby.buildkit.v1.frontend.SolveResponse
-	28, // 86: moby.buildkit.v1.frontend.LLBBridge.ReadFile:output_type -> moby.buildkit.v1.frontend.ReadFileResponse
-	30, // 87: moby.buildkit.v1.frontend.LLBBridge.ReadDir:output_type -> moby.buildkit.v1.frontend.ReadDirResponse
-	32, // 88: moby.buildkit.v1.frontend.LLBBridge.StatFile:output_type -> moby.buildkit.v1.frontend.StatFileResponse
-	34, // 89: moby.buildkit.v1.frontend.LLBBridge.Evaluate:output_type -> moby.buildkit.v1.frontend.EvaluateResponse
-	36, // 90: moby.buildkit.v1.frontend.LLBBridge.Ping:output_type -> moby.buildkit.v1.frontend.PongResponse
-	10, // 91: moby.buildkit.v1.frontend.LLBBridge.Return:output_type -> moby.buildkit.v1.frontend.ReturnResponse
-	12, // 92: moby.buildkit.v1.frontend.LLBBridge.Inputs:output_type -> moby.buildkit.v1.frontend.InputsResponse
-	40, // 93: moby.buildkit.v1.frontend.LLBBridge.NewContainer:output_type -> moby.buildkit.v1.frontend.NewContainerResponse
-	42, // 94: moby.buildkit.v1.frontend.LLBBridge.ReleaseContainer:output_type -> moby.buildkit.v1.frontend.ReleaseContainerResponse
-	43, // 95: moby.buildkit.v1.frontend.LLBBridge.ExecProcess:output_type -> moby.buildkit.v1.frontend.ExecMessage
-	38, // 96: moby.buildkit.v1.frontend.LLBBridge.Warn:output_type -> moby.buildkit.v1.frontend.WarnResponse
-	83, // [83:97] is the sub-list for method output_type
-	69, // [69:83] is the sub-list for method input_type
+	26, // 82: moby.buildkit.v1.frontend.LLBBridge.ReadFileContainer:input_type -> moby.buildkit.v1.frontend.ReadFileRequest
+	29, // 83: moby.buildkit.v1.frontend.LLBBridge.ReadDirContainer:input_type -> moby.buildkit.v1.frontend.ReadDirRequest
+	31, // 84: moby.buildkit.v1.frontend.LLBBridge.StatFileContainer:input_type -> moby.buildkit.v1.frontend.StatFileRequest
+	37, // 85: moby.buildkit.v1.frontend.LLBBridge.Warn:input_type -> moby.buildkit.v1.frontend.WarnRequest
+	14, // 86: moby.buildkit.v1.frontend.LLBBridge.ResolveImageConfig:output_type -> moby.buildkit.v1.frontend.ResolveImageConfigResponse
+	16, // 87: moby.buildkit.v1.frontend.LLBBridge.ResolveSourceMeta:output_type -> moby.buildkit.v1.frontend.ResolveSourceMetaResponse
+	25, // 88: moby.buildkit.v1.frontend.LLBBridge.Solve:output_type -> moby.buildkit.v1.frontend.SolveResponse
+	28, // 89: moby.buildkit.v1.frontend.LLBBridge.ReadFile:output_type -> moby.buildkit.v1.frontend.ReadFileResponse
+	30, // 90: moby.buildkit.v1.frontend.LLBBridge.ReadDir:output_type -> moby.buildkit.v1.frontend.ReadDirResponse
+	32, // 91: moby.buildkit.v1.frontend.LLBBridge.StatFile:output_type -> moby.buildkit.v1.frontend.StatFileResponse
+	34, // 92: moby.buildkit.v1.frontend.LLBBridge.Evaluate:output_type -> moby.buildkit.v1.frontend.EvaluateResponse
+	36, // 93: moby.buildkit.v1.frontend.LLBBridge.Ping:output_type -> moby.buildkit.v1.frontend.PongResponse
+	10, // 94: moby.buildkit.v1.frontend.LLBBridge.Return:output_type -> moby.buildkit.v1.frontend.ReturnResponse
+	12, // 95: moby.buildkit.v1.frontend.LLBBridge.Inputs:output_type -> moby.buildkit.v1.frontend.InputsResponse
+	40, // 96: moby.buildkit.v1.frontend.LLBBridge.NewContainer:output_type -> moby.buildkit.v1.frontend.NewContainerResponse
+	42, // 97: moby.buildkit.v1.frontend.LLBBridge.ReleaseContainer:output_type -> moby.buildkit.v1.frontend.ReleaseContainerResponse
+	43, // 98: moby.buildkit.v1.frontend.LLBBridge.ExecProcess:output_type -> moby.buildkit.v1.frontend.ExecMessage
+	28, // 99: moby.buildkit.v1.frontend.LLBBridge.ReadFileContainer:output_type -> moby.buildkit.v1.frontend.ReadFileResponse
+	30, // 100: moby.buildkit.v1.frontend.LLBBridge.ReadDirContainer:output_type -> moby.buildkit.v1.frontend.ReadDirResponse
+	32, // 101: moby.buildkit.v1.frontend.LLBBridge.StatFileContainer:output_type -> moby.buildkit.v1.frontend.StatFileResponse
+	38, // 102: moby.buildkit.v1.frontend.LLBBridge.Warn:output_type -> moby.buildkit.v1.frontend.WarnResponse
+	86, // [86:103] is the sub-list for method output_type
+	69, // [69:86] is the sub-list for method input_type
 	69, // [69:69] is the sub-list for extension type_name
 	69, // [69:69] is the sub-list for extension extendee
 	0,  // [0:69] is the sub-list for field type_name
@@ -36,6 +36,11 @@ service LLBBridge {
 	rpc ReleaseContainer(ReleaseContainerRequest) returns (ReleaseContainerResponse);
 	rpc ExecProcess(stream ExecMessage) returns (stream ExecMessage);

+	// apicaps:CapGatewayExecFilesystem
+	rpc ReadFileContainer(ReadFileRequest) returns (ReadFileResponse);
+	rpc ReadDirContainer(ReadDirRequest) returns (ReadDirResponse);
+	rpc StatFileContainer(StatFileRequest) returns (StatFileResponse);
+
 	// apicaps:CapGatewayWarnings
 	rpc Warn(WarnRequest) returns (WarnResponse);
 }
@@ -228,6 +233,7 @@ message ReadFileRequest {
 	string Ref = 1;
 	string FilePath = 2;
 	FileRange Range = 3;
+	int32 MountIndex = 4;
 }

 message FileRange {
@@ -243,6 +249,7 @@ message ReadDirRequest {
 	string Ref = 1;
 	string DirPath = 2;
 	string IncludePattern = 3;
+	int32 MountIndex = 4;
 }

 message ReadDirResponse {
@@ -252,6 +259,7 @@ message ReadDirResponse {
 message StatFileRequest {
 	string Ref = 1;
 	string Path = 2;
+	int32 MountIndex = 3;
 }

 message StatFileResponse {
@@ -374,4 +382,4 @@ message Descriptor {
 	string digest = 2;
 	int64 size = 3;
 	map<string, string> annotations = 5;
-}
+}
@@ -32,6 +32,9 @@ const (
 	LLBBridge_NewContainer_FullMethodName       = "/moby.buildkit.v1.frontend.LLBBridge/NewContainer"
 	LLBBridge_ReleaseContainer_FullMethodName   = "/moby.buildkit.v1.frontend.LLBBridge/ReleaseContainer"
 	LLBBridge_ExecProcess_FullMethodName        = "/moby.buildkit.v1.frontend.LLBBridge/ExecProcess"
+	LLBBridge_ReadFileContainer_FullMethodName  = "/moby.buildkit.v1.frontend.LLBBridge/ReadFileContainer"
+	LLBBridge_ReadDirContainer_FullMethodName   = "/moby.buildkit.v1.frontend.LLBBridge/ReadDirContainer"
+	LLBBridge_StatFileContainer_FullMethodName  = "/moby.buildkit.v1.frontend.LLBBridge/StatFileContainer"
 	LLBBridge_Warn_FullMethodName               = "/moby.buildkit.v1.frontend.LLBBridge/Warn"
 )

@@ -60,6 +63,10 @@ type LLBBridgeClient interface {
 	NewContainer(ctx context.Context, in *NewContainerRequest, opts ...grpc.CallOption) (*NewContainerResponse, error)
 	ReleaseContainer(ctx context.Context, in *ReleaseContainerRequest, opts ...grpc.CallOption) (*ReleaseContainerResponse, error)
 	ExecProcess(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[ExecMessage, ExecMessage], error)
+	// apicaps:CapGatewayExecFilesystem
+	ReadFileContainer(ctx context.Context, in *ReadFileRequest, opts ...grpc.CallOption) (*ReadFileResponse, error)
+	ReadDirContainer(ctx context.Context, in *ReadDirRequest, opts ...grpc.CallOption) (*ReadDirResponse, error)
+	StatFileContainer(ctx context.Context, in *StatFileRequest, opts ...grpc.CallOption) (*StatFileResponse, error)
 	// apicaps:CapGatewayWarnings
 	Warn(ctx context.Context, in *WarnRequest, opts ...grpc.CallOption) (*WarnResponse, error)
 }
@@ -205,6 +212,36 @@ func (c *lLBBridgeClient) ExecProcess(ctx context.Context, opts ...grpc.CallOpti
 // This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
 type LLBBridge_ExecProcessClient = grpc.BidiStreamingClient[ExecMessage, ExecMessage]

+func (c *lLBBridgeClient) ReadFileContainer(ctx context.Context, in *ReadFileRequest, opts ...grpc.CallOption) (*ReadFileResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ReadFileResponse)
+	err := c.cc.Invoke(ctx, LLBBridge_ReadFileContainer_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *lLBBridgeClient) ReadDirContainer(ctx context.Context, in *ReadDirRequest, opts ...grpc.CallOption) (*ReadDirResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ReadDirResponse)
+	err := c.cc.Invoke(ctx, LLBBridge_ReadDirContainer_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *lLBBridgeClient) StatFileContainer(ctx context.Context, in *StatFileRequest, opts ...grpc.CallOption) (*StatFileResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(StatFileResponse)
+	err := c.cc.Invoke(ctx, LLBBridge_StatFileContainer_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *lLBBridgeClient) Warn(ctx context.Context, in *WarnRequest, opts ...grpc.CallOption) (*WarnResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(WarnResponse)
@@ -240,6 +277,10 @@ type LLBBridgeServer interface {
 	NewContainer(context.Context, *NewContainerRequest) (*NewContainerResponse, error)
 	ReleaseContainer(context.Context, *ReleaseContainerRequest) (*ReleaseContainerResponse, error)
 	ExecProcess(grpc.BidiStreamingServer[ExecMessage, ExecMessage]) error
+	// apicaps:CapGatewayExecFilesystem
+	ReadFileContainer(context.Context, *ReadFileRequest) (*ReadFileResponse, error)
+	ReadDirContainer(context.Context, *ReadDirRequest) (*ReadDirResponse, error)
+	StatFileContainer(context.Context, *StatFileRequest) (*StatFileResponse, error)
 	// apicaps:CapGatewayWarnings
 	Warn(context.Context, *WarnRequest) (*WarnResponse, error)
 }
@@ -290,6 +331,15 @@ func (UnimplementedLLBBridgeServer) ReleaseContainer(context.Context, *ReleaseCo
 func (UnimplementedLLBBridgeServer) ExecProcess(grpc.BidiStreamingServer[ExecMessage, ExecMessage]) error {
 	return status.Errorf(codes.Unimplemented, "method ExecProcess not implemented")
 }
+func (UnimplementedLLBBridgeServer) ReadFileContainer(context.Context, *ReadFileRequest) (*ReadFileResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ReadFileContainer not implemented")
+}
+func (UnimplementedLLBBridgeServer) ReadDirContainer(context.Context, *ReadDirRequest) (*ReadDirResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ReadDirContainer not implemented")
+}
+func (UnimplementedLLBBridgeServer) StatFileContainer(context.Context, *StatFileRequest) (*StatFileResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method StatFileContainer not implemented")
+}
 func (UnimplementedLLBBridgeServer) Warn(context.Context, *WarnRequest) (*WarnResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method Warn not implemented")
 }
@@ -536,6 +586,60 @@ func _LLBBridge_ExecProcess_Handler(srv interface{}, stream grpc.ServerStream) e
 // This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
 type LLBBridge_ExecProcessServer = grpc.BidiStreamingServer[ExecMessage, ExecMessage]

+func _LLBBridge_ReadFileContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ReadFileRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(LLBBridgeServer).ReadFileContainer(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: LLBBridge_ReadFileContainer_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(LLBBridgeServer).ReadFileContainer(ctx, req.(*ReadFileRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _LLBBridge_ReadDirContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ReadDirRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(LLBBridgeServer).ReadDirContainer(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: LLBBridge_ReadDirContainer_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(LLBBridgeServer).ReadDirContainer(ctx, req.(*ReadDirRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _LLBBridge_StatFileContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(StatFileRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(LLBBridgeServer).StatFileContainer(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: LLBBridge_StatFileContainer_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(LLBBridgeServer).StatFileContainer(ctx, req.(*StatFileRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _LLBBridge_Warn_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(WarnRequest)
 	if err := dec(in); err != nil {
@@ -609,6 +713,18 @@ var LLBBridge_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "ReleaseContainer",
 			Handler:    _LLBBridge_ReleaseContainer_Handler,
 		},
+		{
+			MethodName: "ReadFileContainer",
+			Handler:    _LLBBridge_ReadFileContainer_Handler,
+		},
+		{
+			MethodName: "ReadDirContainer",
+			Handler:    _LLBBridge_ReadDirContainer_Handler,
+		},
+		{
+			MethodName: "StatFileContainer",
+			Handler:    _LLBBridge_StatFileContainer_Handler,
+		},
 		{
 			MethodName: "Warn",
 			Handler:    _LLBBridge_Warn_Handler,
@@ -667,6 +667,7 @@ func (m *ReadFileRequest) CloneVT() *ReadFileRequest {
 	r.Ref = m.Ref
 	r.FilePath = m.FilePath
 	r.Range = m.Range.CloneVT()
+	r.MountIndex = m.MountIndex
 	if len(m.unknownFields) > 0 {
 		r.unknownFields = make([]byte, len(m.unknownFields))
 		copy(r.unknownFields, m.unknownFields)
@@ -725,6 +726,7 @@ func (m *ReadDirRequest) CloneVT() *ReadDirRequest {
 	r.Ref = m.Ref
 	r.DirPath = m.DirPath
 	r.IncludePattern = m.IncludePattern
+	r.MountIndex = m.MountIndex
 	if len(m.unknownFields) > 0 {
 		r.unknownFields = make([]byte, len(m.unknownFields))
 		copy(r.unknownFields, m.unknownFields)
@@ -770,6 +772,7 @@ func (m *StatFileRequest) CloneVT() *StatFileRequest {
 	r := new(StatFileRequest)
 	r.Ref = m.Ref
 	r.Path = m.Path
+	r.MountIndex = m.MountIndex
 	if len(m.unknownFields) > 0 {
 		r.unknownFields = make([]byte, len(m.unknownFields))
 		copy(r.unknownFields, m.unknownFields)
@@ -2264,6 +2267,9 @@ func (this *ReadFileRequest) EqualVT(that *ReadFileRequest) bool {
 	if !this.Range.EqualVT(that.Range) {
 		return false
 	}
+	if this.MountIndex != that.MountIndex {
+		return false
+	}
 	return string(this.unknownFields) == string(that.unknownFields)
 }

@@ -2330,6 +2336,9 @@ func (this *ReadDirRequest) EqualVT(that *ReadDirRequest) bool {
 	if this.IncludePattern != that.IncludePattern {
 		return false
 	}
+	if this.MountIndex != that.MountIndex {
+		return false
+	}
 	return string(this.unknownFields) == string(that.unknownFields)
 }

@@ -2389,6 +2398,9 @@ func (this *StatFileRequest) EqualVT(that *StatFileRequest) bool {
 	if this.Path != that.Path {
 		return false
 	}
+	if this.MountIndex != that.MountIndex {
+		return false
+	}
 	return string(this.unknownFields) == string(that.unknownFields)
 }

@@ -4858,6 +4870,11 @@ func (m *ReadFileRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 		i -= len(m.unknownFields)
 		copy(dAtA[i:], m.unknownFields)
 	}
+	if m.MountIndex != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.MountIndex))
+		i--
+		dAtA[i] = 0x20
+	}
 	if m.Range != nil {
 		size, err := m.Range.MarshalToSizedBufferVT(dAtA[:i])
 		if err != nil {
@@ -4998,6 +5015,11 @@ func (m *ReadDirRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 		i -= len(m.unknownFields)
 		copy(dAtA[i:], m.unknownFields)
 	}
+	if m.MountIndex != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.MountIndex))
+		i--
+		dAtA[i] = 0x20
+	}
 	if len(m.IncludePattern) > 0 {
 		i -= len(m.IncludePattern)
 		copy(dAtA[i:], m.IncludePattern)
@@ -5109,6 +5131,11 @@ func (m *StatFileRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 		i -= len(m.unknownFields)
 		copy(dAtA[i:], m.unknownFields)
 	}
+	if m.MountIndex != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.MountIndex))
+		i--
+		dAtA[i] = 0x18
+	}
 	if len(m.Path) > 0 {
 		i -= len(m.Path)
 		copy(dAtA[i:], m.Path)
@@ -7065,6 +7092,9 @@ func (m *ReadFileRequest) SizeVT() (n int) {
 		l = m.Range.SizeVT()
 		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
 	}
+	if m.MountIndex != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.MountIndex))
+	}
 	n += len(m.unknownFields)
 	return n
 }
@@ -7117,6 +7147,9 @@ func (m *ReadDirRequest) SizeVT() (n int) {
 	if l > 0 {
 		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
 	}
+	if m.MountIndex != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.MountIndex))
+	}
 	n += len(m.unknownFields)
 	return n
 }
@@ -7157,6 +7190,9 @@ func (m *StatFileRequest) SizeVT() (n int) {
 	if l > 0 {
 		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
 	}
+	if m.MountIndex != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.MountIndex))
+	}
 	n += len(m.unknownFields)
 	return n
 }
@@ -12506,6 +12542,25 @@ func (m *ReadFileRequest) UnmarshalVT(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MountIndex", wireType)
+			}
+			m.MountIndex = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.MountIndex |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -12827,6 +12882,25 @@ func (m *ReadDirRequest) UnmarshalVT(dAtA []byte) error {
 			}
 			m.IncludePattern = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MountIndex", wireType)
+			}
+			m.MountIndex = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.MountIndex |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -13035,6 +13109,25 @@ func (m *StatFileRequest) UnmarshalVT(dAtA []byte) error {
 			}
 			m.Path = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MountIndex", wireType)
+			}
+			m.MountIndex = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.MountIndex |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        v3.11.4
 // source: github.com/moby/buildkit/session/auth/auth.proto

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        v3.11.4
 // source: github.com/moby/buildkit/session/filesync/filesync.proto

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        v3.11.4
 // source: github.com/moby/buildkit/session/secrets/secrets.proto

@@ -80,7 +80,8 @@ func MountSSHSocket(ctx context.Context, c session.Caller, opt SocketOpt) (sockP

 	sockPath = filepath.Join(dir, "ssh_auth_sock")

-	l, err := net.Listen("unix", sockPath)
+	listener := net.ListenConfig{}
+	l, err := listener.Listen(context.TODO(), "unix", sockPath)
 	if err != nil {
 		return "", nil, errors.WithStack(err)
 	}
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        v3.11.4
 // source: github.com/moby/buildkit/session/sshforward/ssh.proto

@@ -194,7 +194,8 @@ func toDialer(paths []string, raw bool) (func(context.Context) (net.Conn, error)
 }

 func unixSocketDialer(path string) (net.Conn, error) {
-	return net.DialTimeout("unix", path, 2*time.Second)
+	dialer := net.Dialer{Timeout: 2 * time.Second}
+	return dialer.DialContext(context.TODO(), "unix", path)
 }

 type readOnlyAgent struct {
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        v3.11.4
 // source: github.com/moby/buildkit/session/upload/upload.proto

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        v3.11.4
 // source: github.com/moby/buildkit/solver/errdefs/errdefs.proto

@@ -14,7 +14,7 @@ func init() {
 	typeurl.Register((*Solve)(nil), "github.com/moby/buildkit", "errdefs.Solve+json")
 }

-//nolint:revive,staticcheck
+//nolint:staticcheck
 type IsSolve_Subject isSolve_Subject

 // SolveError will be returned when an error is encountered during a solve that
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        v3.11.4
 // source: github.com/moby/buildkit/solver/pb/ops.proto

@@ -1,4 +1,4 @@
-package moby_buildkit_v1_sourcepolicy //nolint:revive,staticcheck
+package moby_buildkit_v1_sourcepolicy //nolint:staticcheck

 import (
 	"github.com/moby/buildkit/util/gogo/proto"
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        v3.11.4
 // source: github.com/moby/buildkit/sourcepolicy/pb/policy.proto

@@ -0,0 +1,54 @@
+package policysession
+
+import (
+	"github.com/containerd/typeurl/v2"
+	spb "github.com/moby/buildkit/sourcepolicy/pb"
+	"github.com/moby/buildkit/util/grpcerrors"
+	"github.com/pkg/errors"
+)
+
+func init() {
+	typeurl.Register((*DecisionResponse)(nil), "github.com/moby/buildkit", "policysession.DecisionResponse+json")
+}
+
+// DenyMessagesError wraps an error with policy deny messages so they can be
+// propagated as a typed error detail.
+type DenyMessagesError struct {
+	Messages []*DenyMessage
+	error
+}
+
+func (e *DenyMessagesError) Unwrap() error {
+	return e.error
+}
+
+func (e *DenyMessagesError) ToProto() grpcerrors.TypedErrorProto {
+	return &DecisionResponse{
+		Action:       spb.PolicyAction_DENY,
+		DenyMessages: e.Messages,
+	}
+}
+
+// WrapDenyMessages adds deny messages to an error when available.
+func WrapDenyMessages(err error, msgs []*DenyMessage) error {
+	if err == nil || len(msgs) == 0 {
+		return err
+	}
+	return &DenyMessagesError{Messages: msgs, error: err}
+}
+
+// DenyMessages extracts policy deny messages from an error chain.
+func DenyMessages(err error) []*DenyMessage {
+	var out []*DenyMessage
+	var de *DenyMessagesError
+	if errors.As(err, &de) {
+		out = DenyMessages(de.Unwrap())
+		out = append(out, de.Messages...)
+	}
+	return out
+}
+
+// WrapError implements grpcerrors.TypedErrorProto for DecisionResponse.
+func (d *DecisionResponse) WrapError(err error) error {
+	return WrapDenyMessages(err, d.GetDenyMessages())
+}
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        v3.11.4
 // source: github.com/moby/buildkit/sourcepolicy/policysession/policysession.proto

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        v3.11.4
 // source: github.com/moby/buildkit/util/apicaps/pb/caps.proto

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"strings"

 	"github.com/containerd/containerd/v2/core/remotes/docker"
 	remoteserrors "github.com/containerd/containerd/v2/core/remotes/errors"
@@ -81,11 +82,13 @@ func (e *formattedDockerError) Error() string {
 	case 1:
 		return format(e.dErr[0])
 	default:
-		msg := "errors:\n"
+		var msg strings.Builder
+		msg.WriteString("errors:\n")
 		for _, err := range e.dErr {
-			msg += format(err) + "\n"
+			msg.WriteString(format(err))
+			msg.WriteByte('\n')
 		}
-		return msg
+		return msg.String()
 	}
 }

@@ -145,7 +145,7 @@ func (cli *GitCLI) Run(ctx context.Context, args ...string) (_ []byte, err error
 		if cli.exec == nil {
 			cmd = exec.CommandContext(ctx, gitBinary)
 		} else {
-			cmd = exec.Command(gitBinary)
+			cmd = exec.CommandContext(context.TODO(), gitBinary)
 		}

 		cmd.Dir = cli.dir
@@ -20,7 +20,10 @@ type contextKeyT string

 var contextKey = contextKeyT("buildkit/util/resolver/limited")

-var Default = New(4)
+// DefaultMaxConcurrency is the default number of concurrent connections per registry.
+var DefaultMaxConcurrency int64 = 4
+
+var Default = New(int(DefaultMaxConcurrency))

 type Group struct {
 	mu   sync.Mutex
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        v3.11.4
 // source: github.com/moby/buildkit/util/stack/stack.proto

@@ -235,14 +235,17 @@ func (cli *Client) Dialer() func(context.Context) (net.Conn, error) {
 		}
 		switch cli.proto {
 		case "unix":
-			return net.Dial(cli.proto, cli.addr)
+			dialer := net.Dialer{}
+			return dialer.DialContext(ctx, cli.proto, cli.addr)
 		case "npipe":
 			return DialPipe(cli.addr, 32*time.Second)
 		default:
 			if tlsConfig := cli.tlsConfig(); tlsConfig != nil {
-				return tls.Dial(cli.proto, cli.addr, tlsConfig)
+				dialer := tls.Dialer{Config: tlsConfig}
+				return dialer.DialContext(ctx, cli.proto, cli.addr)
 			}
-			return net.Dial(cli.proto, cli.addr)
+			dialer := net.Dialer{}
+			return dialer.DialContext(ctx, cli.proto, cli.addr)
 		}
 	}
 }
@@ -2,6 +2,7 @@ package dockerd

 import (
 	"bytes"
+	"context"
 	"fmt"
 	"io"
 	"os"
@@ -140,7 +141,7 @@ func (d *Daemon) StartWithError(daemonLogs map[string]*bytes.Buffer, providedArg
 	}

 	d.args = append(d.args, providedArgs...)
-	d.cmd = exec.Command(dockerdBinary, d.args...)
+	d.cmd = exec.CommandContext(context.TODO(), dockerdBinary, d.args...)
 	d.cmd.Env = append(d.envs, "DOCKER_SERVICE_PREFER_OFFLINE_IMAGE=1", "BUILDKIT_DEBUG_EXEC_OUTPUT=1", "BUILDKIT_DEBUG_PANIC_ON_ERROR=1")

 	if daemonLogs != nil {
@@ -56,7 +56,7 @@ http:
 		}
 	}

-	cmd := exec.Command("registry", "serve", filepath.Join(dir, "config.yaml")) //nolint:gosec // test utility
+	cmd := exec.CommandContext(context.TODO(), "registry", "serve", filepath.Join(dir, "config.yaml")) //nolint:gosec // test utility
 	rc, err := cmd.StderrPipe()
 	if err != nil {
 		return "", nil, err
@@ -76,7 +76,7 @@ func (sb *sandbox) Cmd(args ...string) *exec.Cmd {
 			args = split
 		}
 	}
-	cmd := exec.Command("buildctl", args...)
+	cmd := exec.CommandContext(context.TODO(), "buildctl", args...)
 	cmd.Env = append(cmd.Env, os.Environ()...)
 	cmd.Env = append(cmd.Env, "BUILDKIT_HOST="+sb.Address())
 	if v := os.Getenv("GO_TEST_COVERPROFILE"); v != "" {
@@ -188,7 +188,7 @@ func printBuildkitdDebugLogs(t *testing.T, addr string) {
 }

 func RootlessSupported(uid int) bool {
-	cmd := exec.Command("sudo", "-u", fmt.Sprintf("#%d", uid), "-i", "--", "exec", "unshare", "-U", "true") //nolint:gosec // test utility
+	cmd := exec.CommandContext(context.TODO(), "sudo", "-u", fmt.Sprintf("#%d", uid), "-i", "--", "exec", "unshare", "-U", "true") //nolint:gosec // test utility
 	b, err := cmd.CombinedOutput()
 	if err != nil {
 		bklog.L.Warnf("rootless mode is not supported on this host: %v (%s)", err, string(b))
@@ -191,7 +191,7 @@ disabled_plugins = ["io.containerd.grpc.v1.cri"]
 		}, c.ExtraEnv...), "containerd-rootless.sh", "-c", configFile)
 	}

-	cmd := exec.Command(containerdArgs[0], containerdArgs[1:]...) //nolint:gosec // test utility
+	cmd := exec.CommandContext(context.TODO(), containerdArgs[0], containerdArgs[1:]...) //nolint:gosec // test utility
 	cmd.Env = append(os.Environ(), c.ExtraEnv...)

 	ctdStop, err := integration.StartCmd(cmd, cfg.Logs)
@@ -278,7 +278,7 @@ func runStargzSnapshotter(cfg *integration.BackendConfig) (address string, cl fu

 	address = filepath.Join(tmpStargzDir, "containerd-stargz-grpc.sock")
 	stargzRootDir := filepath.Join(tmpStargzDir, "root")
-	cmd := exec.Command(binary,
+	cmd := exec.CommandContext(context.TODO(), binary,
 		"--log-level", "debug",
 		"--address", address,
 		"--root", stargzRootDir)
@@ -207,7 +207,8 @@ func (c Moby) New(ctx context.Context, cfg *integration.BackendConfig) (b integr
 	f.Close()
 	os.Remove(localPath)

-	listener, err := net.Listen(buildkitdNetworkProtocol, getBuildkitdNetworkAddr(localPath))
+	listenerConfig := net.ListenConfig{}
+	listener, err := listenerConfig.Listen(context.TODO(), buildkitdNetworkProtocol, getBuildkitdNetworkAddr(localPath))
 	if err != nil {
 		return nil, nil, errors.Wrapf(err, "dockerd listener error: %s", integration.FormatLogs(cfg.Logs))
 	}
@@ -2,6 +2,7 @@ package workers

 import (
 	"bytes"
+	"context"
 	"fmt"
 	"os"
 	"os/exec"
@@ -95,7 +96,7 @@ func runBuildkitd(
 	debugAddress := getBuildkitdDebugAddr(tmpdir)

 	args = append(args, "--root", tmpdir, "--addr", address, "--debug")
-	cmd := exec.Command(args[0], args[1:]...) //nolint:gosec // test utility
+	cmd := exec.CommandContext(context.TODO(), args[0], args[1:]...) //nolint:gosec // test utility
 	cmd.Env = append(
 		os.Environ(),
 		"BUILDKIT_DEBUG_EXEC_OUTPUT=1",
@@ -0,0 +1,172 @@
+package types
+
+import (
+	"strings"
+)
+
+const (
+	githubPrefix                 = "https://github.com/"
+	githubBuilderURIExperimental = githubPrefix + "docker/github-builder-experimental/.github/workflows/"
+	githubBuilderURI             = githubPrefix + "docker/github-builder/.github/workflows/"
+
+	githubIssuer     = "https://token.actions.githubusercontent.com"
+	googleUserIssuer = "https://accounts.google.com"
+	githubUserIssuer = githubPrefix + "login/oauth"
+
+	sigstoreIssuer = "CN=sigstore-intermediate,O=sigstore.dev"
+)
+
+func (s SignatureInfo) DetectKind() Kind {
+	if isDHI(s) {
+		return KindDockerHardenedImage
+	}
+	if isGithubBuilder(s) {
+		return KindDockerGithubBuilder
+	}
+	if isGithubSelfSigned(s) {
+		return KindSelfSignedGithubRepo
+	}
+	if isSelfSigned(s) {
+		return KindSelfSigned
+	}
+	return KindUntrusted
+}
+
+func (s SignatureInfo) Name() string {
+	switch s.Kind {
+	case KindDockerHardenedImage:
+		return s.Kind.String() + " (" + s.DockerReference + ")"
+
+	case KindDockerGithubBuilder:
+		n := s.Kind.String()
+		if strings.HasPrefix(s.Signer.BuildSignerURI, githubBuilderURIExperimental) {
+			n += " Experimental"
+		}
+		n += " (" + strings.TrimPrefix(s.Signer.SourceRepositoryURI, githubPrefix)
+
+		if v, ok := strings.CutPrefix(s.Signer.SourceRepositoryRef, "refs/heads/"); ok {
+			n += "@" + v
+		} else if v, ok := strings.CutPrefix(s.Signer.SourceRepositoryRef, "refs/tags/"); ok {
+			n += "@" + v
+		}
+		n += ")"
+		return n
+
+	case KindSelfSignedGithubRepo:
+
+		return s.Kind.String() + " (" + strings.TrimPrefix(s.Signer.SourceRepositoryURI, githubPrefix) + ")"
+
+	case KindSelfSigned:
+		n := s.Kind.String()
+		if s.Signer.RunnerEnvironment != "github-hosted" {
+			n += " Local"
+		}
+		switch s.Signer.Issuer {
+		case googleUserIssuer:
+			n += " (Google: " + s.Signer.SubjectAlternativeName + ")"
+		case githubUserIssuer:
+			n += " (GitHub: " + s.Signer.SubjectAlternativeName + ")"
+		}
+		return n
+
+	default:
+		return s.Kind.String()
+	}
+}
+
+func isDHI(s SignatureInfo) bool {
+	if !s.IsDHI {
+		return false
+	}
+	if s.DockerReference == "" {
+		return false
+	}
+	return true
+}
+
+func isGithubBuilder(s SignatureInfo) bool {
+	if s.Signer == nil {
+		return false
+	}
+
+	if s.Signer.CertificateIssuer != sigstoreIssuer {
+		return false
+	}
+
+	isGithubBuilder := strings.HasPrefix(s.Signer.BuildSignerURI, githubBuilderURI)
+	isExperimental := strings.HasPrefix(s.Signer.BuildSignerURI, githubBuilderURIExperimental)
+	if !isGithubBuilder && !isExperimental {
+		return false
+	}
+
+	if !strings.HasPrefix(s.Signer.SubjectAlternativeName, githubBuilderURI) && !strings.HasPrefix(s.Signer.SubjectAlternativeName, githubBuilderURIExperimental) {
+		return false
+	}
+
+	if s.Signer.Issuer != githubIssuer {
+		return false
+	}
+
+	if !strings.HasPrefix(s.Signer.SourceRepositoryURI, githubPrefix) {
+		return false
+	}
+
+	if s.Signer.RunnerEnvironment != "github-hosted" {
+		return false
+	}
+
+	if len(s.Timestamps) == 0 {
+		return false
+	}
+
+	if s.SignatureType != SignatureBundleV03 {
+		return false
+	}
+
+	return true
+}
+
+func isSelfSigned(s SignatureInfo) bool {
+	if s.Signer == nil {
+		return false
+	}
+
+	if s.Signer.CertificateIssuer != sigstoreIssuer {
+		return false
+	}
+
+	return true
+}
+
+func isGithubSelfSigned(s SignatureInfo) bool {
+	if s.Signer == nil {
+		return false
+	}
+
+	if s.Signer.CertificateIssuer != sigstoreIssuer {
+		return false
+	}
+
+	if s.Signer.Issuer != githubIssuer {
+		return false
+	}
+
+	if !strings.HasPrefix(s.Signer.SourceRepositoryURI, "https://github.com/") {
+		return false
+	}
+
+	signerURIPrefix := s.Signer.SourceRepositoryURI + "/.github/workflows/"
+	if !strings.HasPrefix(s.Signer.BuildSignerURI, signerURIPrefix) {
+		return false
+	}
+
+	if !strings.HasPrefix(s.Signer.SubjectAlternativeName, signerURIPrefix) {
+		return false
+	}
+
+	if s.Signer.RunnerEnvironment != "github-hosted" {
+		return false
+	}
+
+	return true
+}
@@ -6,6 +6,51 @@ import (
 	"github.com/sigstore/sigstore-go/pkg/fulcio/certificate"
 )

+type Kind int
+
+const (
+	KindDockerGithubBuilder  Kind = 1
+	KindDockerHardenedImage  Kind = 2
+	KindSelfSignedGithubRepo Kind = 3
+	KindSelfSigned           Kind = 4
+	KindUntrusted            Kind = 1000
+)
+
+func (k Kind) String() string {
+	switch k {
+	case KindDockerGithubBuilder:
+		return "Docker GitHub Builder"
+	case KindDockerHardenedImage:
+		return "Docker Hardened Image"
+	case KindSelfSignedGithubRepo:
+		return "GitHub Self-Signed"
+	case KindSelfSigned:
+		return "Self-Signed"
+	case KindUntrusted:
+		return "Untrusted"
+	default:
+		return "Invalid"
+	}
+}
+
+type SignatureType int
+
+const (
+	SignatureBundleV03       SignatureType = 1
+	SignatureSimpleSigningV1 SignatureType = 2
+)
+
+func (st SignatureType) String() string {
+	switch st {
+	case SignatureBundleV03:
+		return "Sigstore Bundle"
+	case SignatureSimpleSigningV1:
+		return "SimpleSigning v1"
+	default:
+		return "Unknown"
+	}
+}
+
 type TimestampVerificationResult struct {
 	Type      string    `json:"type"`
 	URI       string    `json:"uri"`
@@ -18,6 +63,8 @@ type TrustRootStatus struct {
 }

 type SignatureInfo struct {
+	Kind            Kind                          `json:"kind"`
+	SignatureType   SignatureType                 `json:"signatureType"`
 	Signer          *certificate.Summary          `json:"signer,omitempty"`
 	Timestamps      []TimestampVerificationResult `json:"timestamps,omitempty"`
 	DockerReference string                        `json:"dockerReference,omitempty"`
@@ -47,7 +47,12 @@ func NewVerifier(cfg Config) (*Verifier, error) {
 	return v, nil
 }

-func (v *Verifier) VerifyArtifact(ctx context.Context, dgst digest.Digest, bundleBytes []byte) (*types.SignatureInfo, error) {
+func (v *Verifier) VerifyArtifact(ctx context.Context, dgst digest.Digest, bundleBytes []byte, opt ...ArtifactVerifyOpt) (*types.SignatureInfo, error) {
+	opts := &ArtifactVerifyOpts{}
+	for _, o := range opt {
+		o(opts)
+	}
+
 	anyCert, err := anyCerificateIdentity()
 	if err != nil {
 		return nil, errors.WithStack(err)
@@ -87,15 +92,18 @@ func (v *Verifier) VerifyArtifact(ctx context.Context, dgst digest.Digest, bundl
 		return nil, errors.Errorf("no valid signatures found")
 	}

-	if !isSLSAPredicateType(result.Statement.PredicateType) {
+	if !opts.SLSANotRequired && !isSLSAPredicateType(result.Statement.PredicateType) {
 		return nil, errors.Errorf("unexpected predicate type %q, expecting SLSA provenance", result.Statement.PredicateType)
 	}

-	return &types.SignatureInfo{
+	si := &types.SignatureInfo{
 		TrustRootStatus: toRootStatus(st),
 		Signer:          result.Signature.Certificate,
 		Timestamps:      toTimestamps(result.VerifiedTimestamps),
-	}, nil
+		SignatureType:   types.SignatureBundleV03,
+	}
+	si.Kind = si.DetectKind()
+	return si, nil
 }

 func (v *Verifier) VerifyImage(ctx context.Context, provider image.ReferrersProvider, desc ocispecs.Descriptor, platform *ocispecs.Platform) (*types.SignatureInfo, error) {
@@ -191,6 +199,7 @@ func (v *Verifier) VerifyImage(ctx context.Context, provider image.ReferrersProv
 	var dockerReference string

 	var se verify.SignedEntity
+	sigType := types.SignatureBundleV03
 	switch layer.MediaType {
 	case image.ArtifactTypeSigstoreBundle:
 		if mfst.ArtifactType != image.ArtifactTypeSigstoreBundle {
@@ -212,6 +221,7 @@ func (v *Verifier) VerifyImage(ctx context.Context, provider image.ReferrersProv
 		}
 		artifactPolicy = verify.WithArtifactDigest(alg, rawDgst)
 	case image.MediaTypeCosignSimpleSigning:
+		sigType = types.SignatureSimpleSigningV1
 		payloadBytes, err := image.ReadBlob(ctx, sc.Provider, layer)
 		if err != nil {
 			return nil, errors.Wrapf(err, "reading bundle layer %s from signature manifest %s", layer.Digest, sc.SignatureManifest.Digest)
@@ -297,13 +307,16 @@ func (v *Verifier) VerifyImage(ctx context.Context, provider image.ReferrersProv
 		return nil, errors.Errorf("no valid signatures found")
 	}

-	return &types.SignatureInfo{
+	si := &types.SignatureInfo{
 		TrustRootStatus: toRootStatus(st),
 		Signer:          result.Signature.Certificate,
 		Timestamps:      toTimestamps(result.VerifiedTimestamps),
 		DockerReference: dockerReference,
 		IsDHI:           sc.DHI,
-	}, nil
+		SignatureType:   sigType,
+	}
+	si.Kind = si.DetectKind()
+	return si, nil
 }

 func (v *Verifier) loadTrustProvider() (*roots.TrustProvider, error) {
@@ -342,9 +355,7 @@ func anyCerificateIdentity() (verify.PolicyOption, error) {
 		return nil, err
 	}

-	extensions := certificate.Extensions{
-		RunnerEnvironment: "github-hosted",
-	}
+	extensions := certificate.Extensions{}

 	certID, err := verify.NewCertificateIdentity(sanMatcher, issuerMatcher, extensions)
 	if err != nil {
@@ -354,6 +365,18 @@ func anyCerificateIdentity() (verify.PolicyOption, error) {
 	return verify.WithCertificateIdentity(certID), nil
 }

+type ArtifactVerifyOpts struct {
+	SLSANotRequired bool
+}
+
+type ArtifactVerifyOpt func(*ArtifactVerifyOpts)
+
+func WithSLSANotRequired() ArtifactVerifyOpt {
+	return func(o *ArtifactVerifyOpts) {
+		o.SLSANotRequired = true
+	}
+}
+
 func loadBundle(dt []byte) (*bundle.Bundle, error) {
 	var bundle bundle.Bundle
 	bundle.Bundle = new(protobundle.Bundle)
@@ -802,8 +802,8 @@ func MatchPrefixPatterns(globs, target string) bool {
 	for globs != "" {
 		// Extract next non-empty glob in comma-separated list.
 		var glob string
-		if i := strings.Index(globs, ","); i >= 0 {
-			glob, globs = globs[:i], globs[i+1:]
+		if before, after, ok := strings.Cut(globs, ","); ok {
+			glob, globs = before, after
 		} else {
 			glob, globs = globs, ""
 		}
@@ -240,8 +240,8 @@ func isValidName(name string) bool {

 // NewVerifier construct a new [Verifier] from an encoded verifier key.
 func NewVerifier(vkey string) (Verifier, error) {
-	name, vkey := chop(vkey, "+")
-	hash16, key64 := chop(vkey, "+")
+	name, vkey, _ := strings.Cut(vkey, "+")
+	hash16, key64, _ := strings.Cut(vkey, "+")
 	hash, err1 := strconv.ParseUint(hash16, 16, 32)
 	key, err2 := base64.StdEncoding.DecodeString(key64)
 	if len(hash16) != 8 || err1 != nil || err2 != nil || !isValidName(name) || len(key) == 0 {
@@ -273,17 +273,6 @@ func NewVerifier(vkey string) (Verifier, error) {
 	return v, nil
 }

-// chop chops s at the first instance of sep, if any,
-// and returns the text before and after sep.
-// If sep is not present, chop returns before is s and after is empty.
-func chop(s, sep string) (before, after string) {
-	i := strings.Index(s, sep)
-	if i < 0 {
-		return s, ""
-	}
-	return s[:i], s[i+len(sep):]
-}
-
 // verifier is a trivial Verifier implementation.
 type verifier struct {
 	name   string
@@ -297,10 +286,10 @@ func (v *verifier) Verify(msg, sig []byte) bool { return v.verify(msg, sig) }

 // NewSigner constructs a new [Signer] from an encoded signer key.
 func NewSigner(skey string) (Signer, error) {
-	priv1, skey := chop(skey, "+")
-	priv2, skey := chop(skey, "+")
-	name, skey := chop(skey, "+")
-	hash16, key64 := chop(skey, "+")
+	priv1, skey, _ := strings.Cut(skey, "+")
+	priv2, skey, _ := strings.Cut(skey, "+")
+	name, skey, _ := strings.Cut(skey, "+")
+	hash16, key64, _ := strings.Cut(skey, "+")
 	hash, err1 := strconv.ParseUint(hash16, 16, 32)
 	key, err2 := base64.StdEncoding.DecodeString(key64)
 	if priv1 != "PRIVATE" || priv2 != "KEY" || len(hash16) != 8 || err1 != nil || err2 != nil || !isValidName(name) || len(key) == 0 {
@@ -557,7 +546,7 @@ func Open(msg []byte, known Verifiers) (*Note, error) {
 			return nil, errMalformedNote
 		}
 		line = line[len(sigPrefix):]
-		name, b64 := chop(string(line), " ")
+		name, b64, _ := strings.Cut(string(line), " ")
 		sig, err := base64.StdEncoding.DecodeString(b64)
 		if err != nil || !isValidName(name) || b64 == "" || len(sig) < 5 {
 			return nil, errMalformedNote
@@ -376,11 +376,24 @@ type ClientConn struct {
 	// completely unresponsive connection.
 	pendingResets int

+	// readBeforeStreamID is the smallest stream ID that has not been followed by
+	// a frame read from the peer. We use this to determine when a request may
+	// have been sent to a completely unresponsive connection:
+	// If the request ID is less than readBeforeStreamID, then we have had some
+	// indication of life on the connection since sending the request.
+	readBeforeStreamID uint32
+
 	// reqHeaderMu is a 1-element semaphore channel controlling access to sending new requests.
 	// Write to reqHeaderMu to lock it, read from it to unlock.
 	// Lock reqmu BEFORE mu or wmu.
 	reqHeaderMu chan struct{}

+	// internalStateHook reports state changes back to the net/http.ClientConn.
+	// Note that this is different from the user state hook registered by
+	// net/http.ClientConn.SetStateHook: The internal hook calls ClientConn,
+	// which calls the user hook.
+	internalStateHook func()
+
 	// wmu is held while writing.
 	// Acquire BEFORE mu when holding both, to avoid blocking mu on network writes.
 	// Only acquire both at the same time when changing peer settings.
@@ -710,7 +723,7 @@ func canRetryError(err error) bool {

 func (t *Transport) dialClientConn(ctx context.Context, addr string, singleUse bool) (*ClientConn, error) {
 	if t.transportTestHooks != nil {
-		return t.newClientConn(nil, singleUse)
+		return t.newClientConn(nil, singleUse, nil)
 	}
 	host, _, err := net.SplitHostPort(addr)
 	if err != nil {
@@ -720,7 +733,7 @@ func (t *Transport) dialClientConn(ctx context.Context, addr string, singleUse b
 	if err != nil {
 		return nil, err
 	}
-	return t.newClientConn(tconn, singleUse)
+	return t.newClientConn(tconn, singleUse, nil)
 }

 func (t *Transport) newTLSConfig(host string) *tls.Config {
@@ -772,10 +785,10 @@ func (t *Transport) expectContinueTimeout() time.Duration {
 }

 func (t *Transport) NewClientConn(c net.Conn) (*ClientConn, error) {
-	return t.newClientConn(c, t.disableKeepAlives())
+	return t.newClientConn(c, t.disableKeepAlives(), nil)
 }

-func (t *Transport) newClientConn(c net.Conn, singleUse bool) (*ClientConn, error) {
+func (t *Transport) newClientConn(c net.Conn, singleUse bool, internalStateHook func()) (*ClientConn, error) {
 	conf := configFromTransport(t)
 	cc := &ClientConn{
 		t:                           t,
@@ -797,6 +810,7 @@ func (t *Transport) newClientConn(c net.Conn, singleUse bool) (*ClientConn, erro
 		pings:                       make(map[[8]byte]chan struct{}),
 		reqHeaderMu:                 make(chan struct{}, 1),
 		lastActive:                  time.Now(),
+		internalStateHook:           internalStateHook,
 	}
 	if t.transportTestHooks != nil {
 		t.transportTestHooks.newclientconn(cc)
@@ -1037,10 +1051,7 @@ func (cc *ClientConn) idleStateLocked() (st clientConnIdleState) {
 		maxConcurrentOkay = cc.currentRequestCountLocked() < int(cc.maxConcurrentStreams)
 	}

-	st.canTakeNewRequest = cc.goAway == nil && !cc.closed && !cc.closing && maxConcurrentOkay &&
-		!cc.doNotReuse &&
-		int64(cc.nextStreamID)+2*int64(cc.pendingRequests) < math.MaxInt32 &&
-		!cc.tooIdleLocked()
+	st.canTakeNewRequest = maxConcurrentOkay && cc.isUsableLocked()

 	// If this connection has never been used for a request and is closed,
 	// then let it take a request (which will fail).
@@ -1056,6 +1067,31 @@ func (cc *ClientConn) idleStateLocked() (st clientConnIdleState) {
 	return
 }

+func (cc *ClientConn) isUsableLocked() bool {
+	return cc.goAway == nil &&
+		!cc.closed &&
+		!cc.closing &&
+		!cc.doNotReuse &&
+		int64(cc.nextStreamID)+2*int64(cc.pendingRequests) < math.MaxInt32 &&
+		!cc.tooIdleLocked()
+}
+
+// canReserveLocked reports whether a net/http.ClientConn can reserve a slot on this conn.
+//
+// This follows slightly different rules than clientConnIdleState.canTakeNewRequest.
+// We only permit reservations up to the conn's concurrency limit.
+// This differs from ClientConn.ReserveNewRequest, which permits reservations
+// past the limit when StrictMaxConcurrentStreams is set.
+func (cc *ClientConn) canReserveLocked() bool {
+	if cc.currentRequestCountLocked() >= int(cc.maxConcurrentStreams) {
+		return false
+	}
+	if !cc.isUsableLocked() {
+		return false
+	}
+	return true
+}
+
 // currentRequestCountLocked reports the number of concurrency slots currently in use,
 // including active streams, reserved slots, and reset streams waiting for acknowledgement.
 func (cc *ClientConn) currentRequestCountLocked() int {
@@ -1067,6 +1103,14 @@ func (cc *ClientConn) canTakeNewRequestLocked() bool {
 	return st.canTakeNewRequest
 }

+// availableLocked reports the number of concurrency slots available.
+func (cc *ClientConn) availableLocked() int {
+	if !cc.canTakeNewRequestLocked() {
+		return 0
+	}
+	return max(0, int(cc.maxConcurrentStreams)-cc.currentRequestCountLocked())
+}
+
 // tooIdleLocked reports whether this connection has been been sitting idle
 // for too much wall time.
 func (cc *ClientConn) tooIdleLocked() bool {
@@ -1091,6 +1135,7 @@ func (cc *ClientConn) closeConn() {
 	t := time.AfterFunc(250*time.Millisecond, cc.forceCloseConn)
 	defer t.Stop()
 	cc.tconn.Close()
+	cc.maybeCallStateHook()
 }

 // A tls.Conn.Close can hang for a long time if the peer is unresponsive.
@@ -1616,6 +1661,8 @@ func (cs *clientStream) cleanupWriteRequest(err error) {
 	}
 	bodyClosed := cs.reqBodyClosed
 	closeOnIdle := cc.singleUse || cc.doNotReuse || cc.t.disableKeepAlives() || cc.goAway != nil
+	// Have we read any frames from the connection since sending this request?
+	readSinceStream := cc.readBeforeStreamID > cs.ID
 	cc.mu.Unlock()
 	if mustCloseBody {
 		cs.reqBody.Close()
@@ -1647,8 +1694,10 @@ func (cs *clientStream) cleanupWriteRequest(err error) {
 				//
 				// This could be due to the server becoming unresponsive.
 				// To avoid sending too many requests on a dead connection,
-				// we let the request continue to consume a concurrency slot
-				// until we can confirm the server is still responding.
+				// if we haven't read any frames from the connection since
+				// sending this request, we let it continue to consume
+				// a concurrency slot until we can confirm the server is
+				// still responding.
 				// We do this by sending a PING frame along with the RST_STREAM
 				// (unless a ping is already in flight).
 				//
@@ -1659,7 +1708,7 @@ func (cs *clientStream) cleanupWriteRequest(err error) {
 				// because it's short lived and will probably be closed before
 				// we get the ping response.
 				ping := false
-				if !closeOnIdle {
+				if !closeOnIdle && !readSinceStream {
 					cc.mu.Lock()
 					// rstStreamPingsBlocked works around a gRPC behavior:
 					// see comment on the field for details.
@@ -1693,6 +1742,7 @@ func (cs *clientStream) cleanupWriteRequest(err error) {
 	}

 	close(cs.donec)
+	cc.maybeCallStateHook()
 }

 // awaitOpenSlotForStreamLocked waits until len(streams) < maxConcurrentStreams.
@@ -2745,6 +2795,7 @@ func (rl *clientConnReadLoop) streamByID(id uint32, headerOrData bool) *clientSt
 		// See comment on ClientConn.rstStreamPingsBlocked for details.
 		rl.cc.rstStreamPingsBlocked = false
 	}
+	rl.cc.readBeforeStreamID = rl.cc.nextStreamID
 	cs := rl.cc.streams[id]
 	if cs != nil && !cs.readAborted {
 		return cs
@@ -2795,6 +2846,7 @@ func (rl *clientConnReadLoop) processSettings(f *SettingsFrame) error {

 func (rl *clientConnReadLoop) processSettingsNoWrite(f *SettingsFrame) error {
 	cc := rl.cc
+	defer cc.maybeCallStateHook()
 	cc.mu.Lock()
 	defer cc.mu.Unlock()

@@ -2975,6 +3027,7 @@ func (cc *ClientConn) Ping(ctx context.Context) error {
 func (rl *clientConnReadLoop) processPing(f *PingFrame) error {
 	if f.IsAck() {
 		cc := rl.cc
+		defer cc.maybeCallStateHook()
 		cc.mu.Lock()
 		defer cc.mu.Unlock()
 		// If ack, notify listener if any
@@ -3198,9 +3251,13 @@ func registerHTTPSProtocol(t *http.Transport, rt noDialH2RoundTripper) (err erro
 }

 // noDialH2RoundTripper is a RoundTripper which only tries to complete the request
-// if there's already has a cached connection to the host.
+// if there's already a cached connection to the host.
 // (The field is exported so it can be accessed via reflect from net/http; tested
 // by TestNoDialH2RoundTripperType)
+//
+// A noDialH2RoundTripper is registered with http1.Transport.RegisterProtocol,
+// and the http1.Transport can use type assertions to call non-RoundTrip methods on it.
+// This lets us expose, for example, NewClientConn to net/http.
 type noDialH2RoundTripper struct{ *Transport }

 func (rt noDialH2RoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
@@ -3211,6 +3268,85 @@ func (rt noDialH2RoundTripper) RoundTrip(req *http.Request) (*http.Response, err
 	return res, err
 }

+func (rt noDialH2RoundTripper) NewClientConn(conn net.Conn, internalStateHook func()) (http.RoundTripper, error) {
+	tr := rt.Transport
+	cc, err := tr.newClientConn(conn, tr.disableKeepAlives(), internalStateHook)
+	if err != nil {
+		return nil, err
+	}
+
+	// RoundTrip should block when the conn is at its concurrency limit,
+	// not return an error. Setting strictMaxConcurrentStreams enables this.
+	cc.strictMaxConcurrentStreams = true
+
+	return netHTTPClientConn{cc}, nil
+}
+
+// netHTTPClientConn wraps ClientConn and implements the interface net/http expects from
+// the RoundTripper returned by NewClientConn.
+type netHTTPClientConn struct {
+	cc *ClientConn
+}
+
+func (cc netHTTPClientConn) RoundTrip(req *http.Request) (*http.Response, error) {
+	return cc.cc.RoundTrip(req)
+}
+
+func (cc netHTTPClientConn) Close() error {
+	return cc.cc.Close()
+}
+
+func (cc netHTTPClientConn) Err() error {
+	cc.cc.mu.Lock()
+	defer cc.cc.mu.Unlock()
+	if cc.cc.closed {
+		return errors.New("connection closed")
+	}
+	return nil
+}
+
+func (cc netHTTPClientConn) Reserve() error {
+	defer cc.cc.maybeCallStateHook()
+	cc.cc.mu.Lock()
+	defer cc.cc.mu.Unlock()
+	if !cc.cc.canReserveLocked() {
+		return errors.New("connection is unavailable")
+	}
+	cc.cc.streamsReserved++
+	return nil
+}
+
+func (cc netHTTPClientConn) Release() {
+	defer cc.cc.maybeCallStateHook()
+	cc.cc.mu.Lock()
+	defer cc.cc.mu.Unlock()
+	// We don't complain if streamsReserved is 0.
+	//
+	// This is consistent with RoundTrip: both Release and RoundTrip will
+	// consume a reservation iff one exists.
+	if cc.cc.streamsReserved > 0 {
+		cc.cc.streamsReserved--
+	}
+}
+
+func (cc netHTTPClientConn) Available() int {
+	cc.cc.mu.Lock()
+	defer cc.cc.mu.Unlock()
+	return cc.cc.availableLocked()
+}
+
+func (cc netHTTPClientConn) InFlight() int {
+	cc.cc.mu.Lock()
+	defer cc.cc.mu.Unlock()
+	return cc.cc.currentRequestCountLocked()
+}
+
+func (cc *ClientConn) maybeCallStateHook() {
+	if cc.internalStateHook != nil {
+		cc.internalStateHook()
+	}
+}
+
 func (t *Transport) idleConnTimeout() time.Duration {
 	// to keep things backwards compatible, we use non-zero values of
 	// IdleConnTimeout, followed by using the IdleConnTimeout on the underlying
@@ -58,8 +58,8 @@ func RenderEvents(w http.ResponseWriter, req *http.Request, sensitive bool) {
 		Buckets: buckets,
 	}

-	data.Families = make([]string, 0, len(families))
 	famMu.RLock()
+	data.Families = make([]string, 0, len(families))
 	for name := range families {
 		data.Families = append(data.Families, name)
 	}
@@ -144,8 +144,8 @@ func (g *Group) SetLimit(n int) {
 		g.sem = nil
 		return
 	}
-	if len(g.sem) != 0 {
-		panic(fmt.Errorf("errgroup: modify limit while %v goroutines in the group are still active", len(g.sem)))
+	if active := len(g.sem); active != 0 {
+		panic(fmt.Errorf("errgroup: modify limit while %v goroutines in the group are still active", active))
 	}
 	g.sem = make(chan token, n)
 }
@@ -92,9 +92,6 @@ var ARM64 struct {
 	HasSHA2     bool // SHA2 hardware implementation
 	HasCRC32    bool // CRC32 hardware implementation
 	HasATOMICS  bool // Atomic memory operation instruction set
-	HasHPDS     bool // Hierarchical permission disables in translations tables
-	HasLOR      bool // Limited ordering regions
-	HasPAN      bool // Privileged access never
 	HasFPHP     bool // Half precision floating-point instruction set
 	HasASIMDHP  bool // Advanced SIMD half precision instruction set
 	HasCPUID    bool // CPUID identification scheme registers
@@ -65,10 +65,10 @@ func setMinimalFeatures() {
 func readARM64Registers() {
 	Initialized = true

-	parseARM64SystemRegisters(getisar0(), getisar1(), getmmfr1(), getpfr0())
+	parseARM64SystemRegisters(getisar0(), getisar1(), getpfr0())
 }

-func parseARM64SystemRegisters(isar0, isar1, mmfr1, pfr0 uint64) {
+func parseARM64SystemRegisters(isar0, isar1, pfr0 uint64) {
 	// ID_AA64ISAR0_EL1
 	switch extractBits(isar0, 4, 7) {
 	case 1:
@@ -152,22 +152,6 @@ func parseARM64SystemRegisters(isar0, isar1, mmfr1, pfr0 uint64) {
 		ARM64.HasI8MM = true
 	}

-	// ID_AA64MMFR1_EL1
-	switch extractBits(mmfr1, 12, 15) {
-	case 1, 2:
-		ARM64.HasHPDS = true
-	}
-
-	switch extractBits(mmfr1, 16, 19) {
-	case 1:
-		ARM64.HasLOR = true
-	}
-
-	switch extractBits(mmfr1, 20, 23) {
-	case 1, 2, 3:
-		ARM64.HasPAN = true
-	}
-
 	// ID_AA64PFR0_EL1
 	switch extractBits(pfr0, 16, 19) {
 	case 0:
@@ -20,13 +20,6 @@ TEXT ·getisar1(SB),NOSPLIT,$0-8
 	MOVD	R0, ret+0(FP)
 	RET

-// func getmmfr1() uint64
-TEXT ·getmmfr1(SB),NOSPLIT,$0-8
-	// get Memory Model Feature Register 1 into x0
-	MRS	ID_AA64MMFR1_EL1, R0
-	MOVD	R0, ret+0(FP)
-	RET
-
 // func getpfr0() uint64
 TEXT ·getpfr0(SB),NOSPLIT,$0-8
 	// get Processor Feature Register 0 into x0
@@ -8,6 +8,5 @@ package cpu

 func getisar0() uint64
 func getisar1() uint64
-func getmmfr1() uint64
 func getpfr0() uint64
 func getzfr0() uint64
@@ -8,5 +8,4 @@ package cpu

 func getisar0() uint64 { return 0 }
 func getisar1() uint64 { return 0 }
-func getmmfr1() uint64 { return 0 }
 func getpfr0() uint64  { return 0 }
@@ -167,7 +167,7 @@ func doinit() {
 		setMinimalFeatures()
 		return
 	}
-	parseARM64SystemRegisters(cpuid.aa64isar0, cpuid.aa64isar1, cpuid.aa64mmfr1, cpuid.aa64pfr0)
+	parseARM64SystemRegisters(cpuid.aa64isar0, cpuid.aa64isar1, cpuid.aa64pfr0)

 	Initialized = true
 }
@@ -59,7 +59,7 @@ func doinit() {
 	if !ok {
 		return
 	}
-	parseARM64SystemRegisters(isar0, isar1, 0, 0)
+	parseARM64SystemRegisters(isar0, isar1, 0)

 	Initialized = true
 }
@@ -256,6 +256,7 @@ struct ltchars {
 #include <linux/loop.h>
 #include <linux/lwtunnel.h>
 #include <linux/magic.h>
+#include <linux/mei.h>
 #include <linux/memfd.h>
 #include <linux/module.h>
 #include <linux/mount.h>
@@ -613,7 +614,7 @@ ccflags="$@"
 		$2 !~ /IOC_MAGIC/ &&
 		$2 ~ /^[A-Z][A-Z0-9_]+_MAGIC2?$/ ||
 		$2 ~ /^(VM|VMADDR)_/ ||
-		$2 ~ /^IOCTL_VM_SOCKETS_/ ||
+		$2 ~ /^(IOCTL_VM_SOCKETS_|IOCTL_MEI_)/ ||
 		$2 ~ /^(TASKSTATS|TS)_/ ||
 		$2 ~ /^CGROUPSTATS_/ ||
 		$2 ~ /^GENL_/ ||
@@ -1615,6 +1615,8 @@ const (
 	IN_OPEN                                     = 0x20
 	IN_Q_OVERFLOW                               = 0x4000
 	IN_UNMOUNT                                  = 0x2000
+	IOCTL_MEI_CONNECT_CLIENT                    = 0xc0104801
+	IOCTL_MEI_CONNECT_CLIENT_VTAG               = 0xc0144804
 	IPPROTO_AH                                  = 0x33
 	IPPROTO_BEETPH                              = 0x5e
 	IPPROTO_COMP                                = 0x6c
@@ -116,6 +116,8 @@ const (
 	IEXTEN                           = 0x8000
 	IN_CLOEXEC                       = 0x80000
 	IN_NONBLOCK                      = 0x800
+	IOCTL_MEI_NOTIFY_GET             = 0x80044803
+	IOCTL_MEI_NOTIFY_SET             = 0x40044802
 	IOCTL_VM_SOCKETS_GET_LOCAL_CID   = 0x7b9
 	IPV6_FLOWINFO_MASK               = 0xffffff0f
 	IPV6_FLOWLABEL_MASK              = 0xffff0f00
@@ -116,6 +116,8 @@ const (
 	IEXTEN                           = 0x8000
 	IN_CLOEXEC                       = 0x80000
 	IN_NONBLOCK                      = 0x800
+	IOCTL_MEI_NOTIFY_GET             = 0x80044803
+	IOCTL_MEI_NOTIFY_SET             = 0x40044802
 	IOCTL_VM_SOCKETS_GET_LOCAL_CID   = 0x7b9
 	IPV6_FLOWINFO_MASK               = 0xffffff0f
 	IPV6_FLOWLABEL_MASK              = 0xffff0f00
@@ -115,6 +115,8 @@ const (
 	IEXTEN                           = 0x8000
 	IN_CLOEXEC                       = 0x80000
 	IN_NONBLOCK                      = 0x800
+	IOCTL_MEI_NOTIFY_GET             = 0x80044803
+	IOCTL_MEI_NOTIFY_SET             = 0x40044802
 	IOCTL_VM_SOCKETS_GET_LOCAL_CID   = 0x7b9
 	IPV6_FLOWINFO_MASK               = 0xffffff0f
 	IPV6_FLOWLABEL_MASK              = 0xffff0f00
@@ -120,6 +120,8 @@ const (
 	IEXTEN                           = 0x8000
 	IN_CLOEXEC                       = 0x80000
 	IN_NONBLOCK                      = 0x800
+	IOCTL_MEI_NOTIFY_GET             = 0x80044803
+	IOCTL_MEI_NOTIFY_SET             = 0x40044802
 	IOCTL_VM_SOCKETS_GET_LOCAL_CID   = 0x7b9
 	IPV6_FLOWINFO_MASK               = 0xffffff0f
 	IPV6_FLOWLABEL_MASK              = 0xffff0f00
@@ -116,6 +116,8 @@ const (
 	IEXTEN                           = 0x8000
 	IN_CLOEXEC                       = 0x80000
 	IN_NONBLOCK                      = 0x800
+	IOCTL_MEI_NOTIFY_GET             = 0x80044803
+	IOCTL_MEI_NOTIFY_SET             = 0x40044802
 	IOCTL_VM_SOCKETS_GET_LOCAL_CID   = 0x7b9
 	IPV6_FLOWINFO_MASK               = 0xffffff0f
 	IPV6_FLOWLABEL_MASK              = 0xffff0f00
@@ -115,6 +115,8 @@ const (
 	IEXTEN                           = 0x100
 	IN_CLOEXEC                       = 0x80000
 	IN_NONBLOCK                      = 0x80
+	IOCTL_MEI_NOTIFY_GET             = 0x40044803
+	IOCTL_MEI_NOTIFY_SET             = 0x80044802
 	IOCTL_VM_SOCKETS_GET_LOCAL_CID   = 0x200007b9
 	IPV6_FLOWINFO_MASK               = 0xfffffff
 	IPV6_FLOWLABEL_MASK              = 0xfffff
@@ -115,6 +115,8 @@ const (
 	IEXTEN                           = 0x100
 	IN_CLOEXEC                       = 0x80000
 	IN_NONBLOCK                      = 0x80
+	IOCTL_MEI_NOTIFY_GET             = 0x40044803
+	IOCTL_MEI_NOTIFY_SET             = 0x80044802
 	IOCTL_VM_SOCKETS_GET_LOCAL_CID   = 0x200007b9
 	IPV6_FLOWINFO_MASK               = 0xfffffff
 	IPV6_FLOWLABEL_MASK              = 0xfffff
@@ -115,6 +115,8 @@ const (
 	IEXTEN                           = 0x100
 	IN_CLOEXEC                       = 0x80000
 	IN_NONBLOCK                      = 0x80
+	IOCTL_MEI_NOTIFY_GET             = 0x40044803
+	IOCTL_MEI_NOTIFY_SET             = 0x80044802
 	IOCTL_VM_SOCKETS_GET_LOCAL_CID   = 0x200007b9
 	IPV6_FLOWINFO_MASK               = 0xffffff0f
 	IPV6_FLOWLABEL_MASK              = 0xffff0f00
@@ -115,6 +115,8 @@ const (
 	IEXTEN                           = 0x100
 	IN_CLOEXEC                       = 0x80000
 	IN_NONBLOCK                      = 0x80
+	IOCTL_MEI_NOTIFY_GET             = 0x40044803
+	IOCTL_MEI_NOTIFY_SET             = 0x80044802
 	IOCTL_VM_SOCKETS_GET_LOCAL_CID   = 0x200007b9
 	IPV6_FLOWINFO_MASK               = 0xffffff0f
 	IPV6_FLOWLABEL_MASK              = 0xffff0f00
@@ -115,6 +115,8 @@ const (
 	IEXTEN                           = 0x400
 	IN_CLOEXEC                       = 0x80000
 	IN_NONBLOCK                      = 0x800
+	IOCTL_MEI_NOTIFY_GET             = 0x40044803
+	IOCTL_MEI_NOTIFY_SET             = 0x80044802
 	IOCTL_VM_SOCKETS_GET_LOCAL_CID   = 0x200007b9
 	IPV6_FLOWINFO_MASK               = 0xfffffff
 	IPV6_FLOWLABEL_MASK              = 0xfffff
@@ -115,6 +115,8 @@ const (
 	IEXTEN                           = 0x400
 	IN_CLOEXEC                       = 0x80000
 	IN_NONBLOCK                      = 0x800
+	IOCTL_MEI_NOTIFY_GET             = 0x40044803
+	IOCTL_MEI_NOTIFY_SET             = 0x80044802
 	IOCTL_VM_SOCKETS_GET_LOCAL_CID   = 0x200007b9
 	IPV6_FLOWINFO_MASK               = 0xfffffff
 	IPV6_FLOWLABEL_MASK              = 0xfffff
@@ -115,6 +115,8 @@ const (
 	IEXTEN                           = 0x400
 	IN_CLOEXEC                       = 0x80000
 	IN_NONBLOCK                      = 0x800
+	IOCTL_MEI_NOTIFY_GET             = 0x40044803
+	IOCTL_MEI_NOTIFY_SET             = 0x80044802
 	IOCTL_VM_SOCKETS_GET_LOCAL_CID   = 0x200007b9
 	IPV6_FLOWINFO_MASK               = 0xffffff0f
 	IPV6_FLOWLABEL_MASK              = 0xffff0f00
@@ -115,6 +115,8 @@ const (
 	IEXTEN                           = 0x8000
 	IN_CLOEXEC                       = 0x80000
 	IN_NONBLOCK                      = 0x800
+	IOCTL_MEI_NOTIFY_GET             = 0x80044803
+	IOCTL_MEI_NOTIFY_SET             = 0x40044802
 	IOCTL_VM_SOCKETS_GET_LOCAL_CID   = 0x7b9
 	IPV6_FLOWINFO_MASK               = 0xffffff0f
 	IPV6_FLOWLABEL_MASK              = 0xffff0f00
@@ -115,6 +115,8 @@ const (
 	IEXTEN                           = 0x8000
 	IN_CLOEXEC                       = 0x80000
 	IN_NONBLOCK                      = 0x800
+	IOCTL_MEI_NOTIFY_GET             = 0x80044803
+	IOCTL_MEI_NOTIFY_SET             = 0x40044802
 	IOCTL_VM_SOCKETS_GET_LOCAL_CID   = 0x7b9
 	IPV6_FLOWINFO_MASK               = 0xfffffff
 	IPV6_FLOWLABEL_MASK              = 0xfffff
@@ -119,6 +119,8 @@ const (
 	IEXTEN                           = 0x8000
 	IN_CLOEXEC                       = 0x400000
 	IN_NONBLOCK                      = 0x4000
+	IOCTL_MEI_NOTIFY_GET             = 0x40044803
+	IOCTL_MEI_NOTIFY_SET             = 0x80044802
 	IOCTL_VM_SOCKETS_GET_LOCAL_CID   = 0x200007b9
 	IPV6_FLOWINFO_MASK               = 0xfffffff
 	IPV6_FLOWLABEL_MASK              = 0xfffff
@@ -104,7 +104,7 @@ type Statvfs_t struct {
 	Fsid        uint32
 	Namemax     uint32
 	Owner       uint32
-	Spare       [4]uint32
+	Spare       [4]uint64
 	Fstypename  [32]byte
 	Mntonname   [1024]byte
 	Mntfromname [1024]byte
@@ -467,7 +467,9 @@ func (c Cursor) FindByPos(start, end token.Pos) (Cursor, bool) {
 	// This algorithm could be implemented using c.Inspect,
 	// but it is about 2.5x slower.

-	best := int32(-1) // push index of latest (=innermost) node containing range
+	// best is the push-index of the latest (=innermost) node containing range.
+	// (Beware: latest is not always innermost because FuncDecl.{Name,Type} overlap.)
+	best := int32(-1)
 	for i, limit := c.indices(); i < limit; i++ {
 		ev := events[i]
 		if ev.index > i { // push?
@@ -481,6 +483,19 @@ func (c Cursor) FindByPos(start, end token.Pos) (Cursor, bool) {
 					continue
 				}
 			} else {
+				// Edge case: FuncDecl.Name and .Type overlap:
+				// Don't update best from Name to FuncDecl.Type.
+				//
+				// The condition can be read as:
+				// - n is FuncType
+				// - n.parent is FuncDecl
+				// - best is strictly beneath the FuncDecl
+				if ev.typ == 1<<nFuncType &&
+					events[ev.parent].typ == 1<<nFuncDecl &&
+					best > ev.parent {
+					continue
+				}
+
 				nodeEnd = n.End()
 				if n.Pos() > start {
 					break // disjoint, after; stop
@@ -78,7 +78,7 @@ func PrintErrors(pkgs []*Package) int {
 	return n
 }

-// Postorder returns an iterator over the the packages in
+// Postorder returns an iterator over the packages in
 // the import graph whose roots are pkg.
 // Packages are enumerated in dependencies-first order.
 func Postorder(pkgs []*Package) iter.Seq[*Package] {
@@ -249,7 +249,7 @@ func (enc *Encoder) For(obj types.Object) (Path, error) {

 	case *types.Func:
 		// A func, if not package-level, must be a method.
-		if recv := obj.Type().(*types.Signature).Recv(); recv == nil {
+		if recv := obj.Signature().Recv(); recv == nil {
 			return "", fmt.Errorf("func is not a method: %v", obj)
 		}

@@ -405,7 +405,7 @@ func (enc *Encoder) concreteMethod(meth *types.Func) (Path, bool) {
 		return "", false
 	}

-	_, named := typesinternal.ReceiverNamed(meth.Type().(*types.Signature).Recv())
+	_, named := typesinternal.ReceiverNamed(meth.Signature().Recv())
 	if named == nil {
 		return "", false
 	}
@@ -304,8 +304,7 @@ func (h hasher) hash(t types.Type) uint32 {
 	case *types.Named:
 		hash := h.hashTypeName(t.Obj())
 		targs := t.TypeArgs()
-		for i := 0; i < targs.Len(); i++ {
-			targ := targs.At(i)
+		for targ := range targs.Types() {
 			hash += 2 * h.hash(targ)
 		}
 		return hash
@@ -34,7 +34,7 @@ type fileInfo struct {
 const maxlines = 64 * 1024

 func (s *fakeFileSet) pos(file string, line, column int) token.Pos {
-	// TODO(mdempsky): Make use of column.
+	_ = column // TODO(mdempsky): Make use of column.

 	// Since we don't know the set of needed file positions, we reserve maxlines
 	// positions per file. We delay calling token.File.SetLines until all
@@ -829,8 +829,7 @@ func (p *iexporter) doDecl(obj types.Object) {
 			// their name must be qualified before exporting recv.
 			if rparams := sig.RecvTypeParams(); rparams.Len() > 0 {
 				prefix := obj.Name() + "." + m.Name()
-				for i := 0; i < rparams.Len(); i++ {
-					rparam := rparams.At(i)
+				for rparam := range rparams.TypeParams() {
 					name := tparamExportName(prefix, rparam)
 					w.p.tparamNames[rparam.Obj()] = name
 				}
@@ -944,6 +943,13 @@ func (w *exportWriter) posV0(pos token.Pos) {
 }

 func (w *exportWriter) pkg(pkg *types.Package) {
+	if pkg == nil {
+		// [exportWriter.typ] accepts a nil pkg only for types
+		// of constants, which cannot contain named objects
+		// such as fields or methods and thus should never
+		// reach this method (#76222).
+		panic("nil package")
+	}
 	// Ensure any referenced packages are declared in the main index.
 	w.p.allPkgs[pkg] = true

@@ -959,9 +965,11 @@ func (w *exportWriter) qualifiedType(obj *types.TypeName) {
 	w.pkg(obj.Pkg())
 }

-// TODO(rfindley): what does 'pkg' even mean here? It would be better to pass
-// it in explicitly into signatures and structs that may use it for
-// constructing fields.
+// typ emits the specified type.
+//
+// Objects within the type (struct fields and interface methods) are
+// qualified by pkg. It may be nil if the type cannot contain objects,
+// such as the type of a constant.
 func (w *exportWriter) typ(t types.Type, pkg *types.Package) {
 	w.data.uint64(w.p.typOff(t, pkg))
 }
@@ -991,6 +999,7 @@ func (w *exportWriter) startType(k itag) {
 	w.data.uint64(uint64(k))
 }

+// doTyp is the implementation of [exportWriter.typ].
 func (w *exportWriter) doTyp(t types.Type, pkg *types.Package) {
 	if trace {
 		w.p.trace("exporting type %s (%T)", t, t)
@@ -1064,7 +1073,7 @@ func (w *exportWriter) doTyp(t types.Type, pkg *types.Package) {

 	case *types.Signature:
 		w.startType(signatureType)
-		w.pkg(pkg)
+		w.pkg(pkg) // qualifies param/result vars
 		w.signature(t)

 	case *types.Struct:
@@ -1110,19 +1119,19 @@ func (w *exportWriter) doTyp(t types.Type, pkg *types.Package) {

 	case *types.Interface:
 		w.startType(interfaceType)
-		w.pkg(pkg)
+		w.pkg(pkg) // qualifies unexported method funcs

 		n := t.NumEmbeddeds()
 		w.uint64(uint64(n))
 		for i := 0; i < n; i++ {
 			ft := t.EmbeddedType(i)
-			tPkg := pkg
 			if named, _ := types.Unalias(ft).(*types.Named); named != nil {
 				w.pos(named.Obj().Pos())
 			} else {
+				// e.g. ~int
 				w.pos(token.NoPos)
 			}
-			w.typ(ft, tPkg)
+			w.typ(ft, pkg)
 		}

 		// See comment for struct fields. In shallow mode we change the encoding
@@ -1223,20 +1232,19 @@ func (w *exportWriter) signature(sig *types.Signature) {

 func (w *exportWriter) typeList(ts *types.TypeList, pkg *types.Package) {
 	w.uint64(uint64(ts.Len()))
-	for i := 0; i < ts.Len(); i++ {
-		w.typ(ts.At(i), pkg)
+	for t := range ts.Types() {
+		w.typ(t, pkg)
 	}
 }

 func (w *exportWriter) tparamList(prefix string, list *types.TypeParamList, pkg *types.Package) {
 	ll := uint64(list.Len())
 	w.uint64(ll)
-	for i := 0; i < list.Len(); i++ {
-		tparam := list.At(i)
+	for tparam := range list.TypeParams() {
 		// Set the type parameter exportName before exporting its type.
 		exportName := tparamExportName(prefix, tparam)
 		w.p.tparamNames[tparam.Obj()] = exportName
-		w.typ(list.At(i), pkg)
+		w.typ(tparam, pkg)
 	}
 }

@@ -432,10 +432,10 @@ func (p *iimporter) doDecl(pkg *types.Package, name string) {
 		errorf("%v.%v not in index", pkg, name)
 	}

-	r := &importReader{p: p, currPkg: pkg}
+	r := &importReader{p: p}
 	r.declReader.Reset(p.declData[off:])

-	r.obj(name)
+	r.obj(pkg, name)
 }

 func (p *iimporter) stringAt(off uint64) string {
@@ -551,7 +551,6 @@ func canReuse(def *types.Named, rhs types.Type) bool {
 type importReader struct {
 	p          *iimporter
 	declReader bytes.Reader
-	currPkg    *types.Package
 	prevFile   string
 	prevLine   int64
 	prevColumn int64
@@ -565,7 +564,8 @@ type importReader struct {
 // for 1.24, but the fix was not worth back-porting).
 var markBlack = func(name *types.TypeName) {}

-func (r *importReader) obj(name string) {
+// obj decodes and declares the package-level object denoted by (pkg, name).
+func (r *importReader) obj(pkg *types.Package, name string) {
 	tag := r.byte()
 	pos := r.pos()

@@ -576,27 +576,27 @@ func (r *importReader) obj(name string) {
 			tparams = r.tparamList()
 		}
 		typ := r.typ()
-		obj := aliases.NewAlias(r.p.aliases, pos, r.currPkg, name, typ, tparams)
+		obj := aliases.NewAlias(r.p.aliases, pos, pkg, name, typ, tparams)
 		markBlack(obj) // workaround for golang/go#69912
 		r.declare(obj)

 	case constTag:
 		typ, val := r.value()

-		r.declare(types.NewConst(pos, r.currPkg, name, typ, val))
+		r.declare(types.NewConst(pos, pkg, name, typ, val))

 	case funcTag, genericFuncTag:
 		var tparams []*types.TypeParam
 		if tag == genericFuncTag {
 			tparams = r.tparamList()
 		}
-		sig := r.signature(nil, nil, tparams)
-		r.declare(types.NewFunc(pos, r.currPkg, name, sig))
+		sig := r.signature(pkg, nil, nil, tparams)
+		r.declare(types.NewFunc(pos, pkg, name, sig))

 	case typeTag, genericTypeTag:
 		// Types can be recursive. We need to setup a stub
 		// declaration before recursing.
-		obj := types.NewTypeName(pos, r.currPkg, name, nil)
+		obj := types.NewTypeName(pos, pkg, name, nil)
 		named := types.NewNamed(obj, nil, nil)

 		markBlack(obj) // workaround for golang/go#69912
@@ -616,7 +616,7 @@ func (r *importReader) obj(name string) {
 			for n := r.uint64(); n > 0; n-- {
 				mpos := r.pos()
 				mname := r.ident()
-				recv := r.param()
+				recv := r.param(pkg)

 				// If the receiver has any targs, set those as the
 				// rparams of the method (since those are the
@@ -630,9 +630,9 @@ func (r *importReader) obj(name string) {
 						rparams[i] = types.Unalias(targs.At(i)).(*types.TypeParam)
 					}
 				}
-				msig := r.signature(recv, rparams, nil)
+				msig := r.signature(pkg, recv, rparams, nil)

-				named.AddMethod(types.NewFunc(mpos, r.currPkg, mname, msig))
+				named.AddMethod(types.NewFunc(mpos, pkg, mname, msig))
 			}
 		}

@@ -644,12 +644,12 @@ func (r *importReader) obj(name string) {
 			errorf("unexpected type param type")
 		}
 		name0 := tparamName(name)
-		tn := types.NewTypeName(pos, r.currPkg, name0, nil)
+		tn := types.NewTypeName(pos, pkg, name0, nil)
 		t := types.NewTypeParam(tn, nil)

 		// To handle recursive references to the typeparam within its
 		// bound, save the partial type in tparamIndex before reading the bounds.
-		id := ident{r.currPkg, name}
+		id := ident{pkg, name}
 		r.p.tparamIndex[id] = t
 		var implicit bool
 		if r.p.version >= iexportVersionGo1_18 {
@@ -672,7 +672,7 @@ func (r *importReader) obj(name string) {
 	case varTag:
 		typ := r.typ()

-		v := types.NewVar(pos, r.currPkg, name, typ)
+		v := types.NewVar(pos, pkg, name, typ)
 		typesinternal.SetVarKind(v, typesinternal.PackageVar)
 		r.declare(v)

@@ -905,11 +905,11 @@ func (r *importReader) doType(base *types.Named) (res types.Type) {
 	case mapType:
 		return types.NewMap(r.typ(), r.typ())
 	case signatureType:
-		r.currPkg = r.pkg()
-		return r.signature(nil, nil, nil)
+		paramPkg := r.pkg()
+		return r.signature(paramPkg, nil, nil, nil)

 	case structType:
-		r.currPkg = r.pkg()
+		fieldPkg := r.pkg()

 		fields := make([]*types.Var, r.uint64())
 		tags := make([]string, len(fields))
@@ -932,7 +932,7 @@ func (r *importReader) doType(base *types.Named) (res types.Type) {
 			// discussed in iexport.go, this is not correct, but mostly works and is
 			// preferable to failing (for now at least).
 			if field == nil {
-				field = types.NewField(fpos, r.currPkg, fname, ftyp, emb)
+				field = types.NewField(fpos, fieldPkg, fname, ftyp, emb)
 			}

 			fields[i] = field
@@ -941,7 +941,7 @@ func (r *importReader) doType(base *types.Named) (res types.Type) {
 		return types.NewStruct(fields, tags)

 	case interfaceType:
-		r.currPkg = r.pkg()
+		methodPkg := r.pkg() // qualifies methods and their param/result vars

 		embeddeds := make([]types.Type, r.uint64())
 		for i := range embeddeds {
@@ -963,12 +963,12 @@ func (r *importReader) doType(base *types.Named) (res types.Type) {
 			// don't agree with this.
 			var recv *types.Var
 			if base != nil {
-				recv = types.NewVar(token.NoPos, r.currPkg, "", base)
+				recv = types.NewVar(token.NoPos, methodPkg, "", base)
 			}
-			msig := r.signature(recv, nil, nil)
+			msig := r.signature(methodPkg, recv, nil, nil)

 			if method == nil {
-				method = types.NewFunc(mpos, r.currPkg, mname, msig)
+				method = types.NewFunc(mpos, methodPkg, mname, msig)
 			}
 			methods[i] = method
 		}
@@ -1049,9 +1049,9 @@ func (r *importReader) objectPathObject() types.Object {
 	return obj
 }

-func (r *importReader) signature(recv *types.Var, rparams []*types.TypeParam, tparams []*types.TypeParam) *types.Signature {
-	params := r.paramList()
-	results := r.paramList()
+func (r *importReader) signature(paramPkg *types.Package, recv *types.Var, rparams []*types.TypeParam, tparams []*types.TypeParam) *types.Signature {
+	params := r.paramList(paramPkg)
+	results := r.paramList(paramPkg)
 	variadic := params.Len() > 0 && r.bool()
 	return types.NewSignatureType(recv, rparams, tparams, params, results, variadic)
 }
@@ -1070,19 +1070,19 @@ func (r *importReader) tparamList() []*types.TypeParam {
 	return xs
 }

-func (r *importReader) paramList() *types.Tuple {
+func (r *importReader) paramList(pkg *types.Package) *types.Tuple {
 	xs := make([]*types.Var, r.uint64())
 	for i := range xs {
-		xs[i] = r.param()
+		xs[i] = r.param(pkg)
 	}
 	return types.NewTuple(xs...)
 }

-func (r *importReader) param() *types.Var {
+func (r *importReader) param(pkg *types.Package) *types.Var {
 	pos := r.pos()
 	name := r.ident()
 	typ := r.typ()
-	return types.NewParam(pos, r.currPkg, name, typ)
+	return types.NewParam(pos, pkg, name, typ)
 }

 func (r *importReader) bool() bool {
@@ -12,354 +12,508 @@ type pkginfo struct {
 }

 var deps = [...]pkginfo{
-	{"archive/tar", "\x03k\x03E;\x01\n\x01$\x01\x01\x02\x05\b\x02\x01\x02\x02\f"},
-	{"archive/zip", "\x02\x04a\a\x03\x12\x021;\x01+\x05\x01\x0f\x03\x02\x0e\x04"},
-	{"bufio", "\x03k\x83\x01D\x14"},
-	{"bytes", "n*Y\x03\fG\x02\x02"},
+	{"archive/tar", "\x03n\x03E<\x01\n\x01$\x01\x01\x02\x05\b\x02\x01\x02\x02\f"},
+	{"archive/zip", "\x02\x04d\a\x03\x12\x021<\x01+\x05\x01\x0f\x03\x02\x0e\x04"},
+	{"bufio", "\x03n\x84\x01D\x14"},
+	{"bytes", "q*Z\x03\fG\x02\x02"},
 	{"cmp", ""},
-	{"compress/bzip2", "\x02\x02\xed\x01A"},
-	{"compress/flate", "\x02l\x03\x80\x01\f\x033\x01\x03"},
-	{"compress/gzip", "\x02\x04a\a\x03\x14lT"},
-	{"compress/lzw", "\x02l\x03\x80\x01"},
-	{"compress/zlib", "\x02\x04a\a\x03\x12\x01m"},
-	{"container/heap", "\xb3\x02"},
+	{"compress/bzip2", "\x02\x02\xf1\x01A"},
+	{"compress/flate", "\x02o\x03\x81\x01\f\x033\x01\x03"},
+	{"compress/gzip", "\x02\x04d\a\x03\x14mT"},
+	{"compress/lzw", "\x02o\x03\x81\x01"},
+	{"compress/zlib", "\x02\x04d\a\x03\x12\x01n"},
+	{"container/heap", "\xb7\x02"},
 	{"container/list", ""},
 	{"container/ring", ""},
-	{"context", "n\\m\x01\r"},
-	{"crypto", "\x83\x01nC"},
-	{"crypto/aes", "\x10\n\a\x93\x02"},
-	{"crypto/cipher", "\x03\x1e\x01\x01\x1e\x11\x1c+X"},
-	{"crypto/des", "\x10\x13\x1e-+\x9b\x01\x03"},
-	{"crypto/dsa", "A\x04)\x83\x01\r"},
-	{"crypto/ecdh", "\x03\v\f\x0e\x04\x15\x04\r\x1c\x83\x01"},
-	{"crypto/ecdsa", "\x0e\x05\x03\x04\x01\x0e\a\v\x05\x01\x04\f\x01\x1c\x83\x01\r\x05K\x01"},
-	{"crypto/ed25519", "\x0e\x1c\x11\x06\n\a\x1c\x83\x01C"},
-	{"crypto/elliptic", "0>\x83\x01\r9"},
-	{"crypto/fips140", " \x05"},
-	{"crypto/hkdf", "-\x13\x01-\x15"},
-	{"crypto/hmac", "\x1a\x14\x12\x01\x111"},
-	{"crypto/internal/boring", "\x0e\x02\rf"},
-	{"crypto/internal/boring/bbig", "\x1a\xe4\x01M"},
-	{"crypto/internal/boring/bcache", "\xb8\x02\x13"},
+	{"context", "q[o\x01\r"},
+	{"crypto", "\x86\x01oC"},
+	{"crypto/aes", "\x10\n\t\x95\x02"},
+	{"crypto/cipher", "\x03 \x01\x01\x1f\x11\x1c+Y"},
+	{"crypto/des", "\x10\x15\x1f-+\x9c\x01\x03"},
+	{"crypto/dsa", "D\x04)\x84\x01\r"},
+	{"crypto/ecdh", "\x03\v\f\x10\x04\x16\x04\r\x1c\x84\x01"},
+	{"crypto/ecdsa", "\x0e\x05\x03\x04\x01\x10\a\v\x06\x01\x04\f\x01\x1c\x84\x01\r\x05K\x01"},
+	{"crypto/ed25519", "\x0e\x1e\x11\a\n\a\x1c\x84\x01C"},
+	{"crypto/elliptic", "2?\x84\x01\r9"},
+	{"crypto/fips140", "\"\x05"},
+	{"crypto/hkdf", "/\x14\x01-\x15"},
+	{"crypto/hmac", "\x1a\x16\x13\x01\x111"},
+	{"crypto/internal/boring", "\x0e\x02\ri"},
+	{"crypto/internal/boring/bbig", "\x1a\xe8\x01M"},
+	{"crypto/internal/boring/bcache", "\xbc\x02\x13"},
 	{"crypto/internal/boring/sig", ""},
-	{"crypto/internal/cryptotest", "\x03\r\n\x06$\x0e\x19\x06\x12\x12 \x04\a\t\x16\x01\x11\x11\x1b\x01\a\x05\b\x03\x05\v"},
-	{"crypto/internal/entropy", "F"},
-	{"crypto/internal/fips140", "?/\x15\xa7\x01\v\x16"},
-	{"crypto/internal/fips140/aes", "\x03\x1d\x03\x02\x13\x05\x01\x01\x05*\x92\x014"},
-	{"crypto/internal/fips140/aes/gcm", " \x01\x02\x02\x02\x11\x05\x01\x06*\x8f\x01"},
-	{"crypto/internal/fips140/alias", "\xcb\x02"},
-	{"crypto/internal/fips140/bigmod", "%\x18\x01\x06*\x92\x01"},
-	{"crypto/internal/fips140/check", " \x0e\x06\t\x02\xb2\x01Z"},
-	{"crypto/internal/fips140/check/checktest", "%\x85\x02!"},
-	{"crypto/internal/fips140/drbg", "\x03\x1c\x01\x01\x04\x13\x05\b\x01(\x83\x01\x0f7"},
-	{"crypto/internal/fips140/ecdh", "\x03\x1d\x05\x02\t\r1\x83\x01\x0f7"},
-	{"crypto/internal/fips140/ecdsa", "\x03\x1d\x04\x01\x02\a\x02\x068\x15nF"},
-	{"crypto/internal/fips140/ed25519", "\x03\x1d\x05\x02\x04\v8\xc6\x01\x03"},
-	{"crypto/internal/fips140/edwards25519", "%\a\f\x051\x92\x017"},
-	{"crypto/internal/fips140/edwards25519/field", "%\x13\x051\x92\x01"},
-	{"crypto/internal/fips140/hkdf", "\x03\x1d\x05\t\x06:\x15"},
-	{"crypto/internal/fips140/hmac", "\x03\x1d\x14\x01\x018\x15"},
-	{"crypto/internal/fips140/mlkem", "\x03\x1d\x05\x02\x0e\x03\x051"},
-	{"crypto/internal/fips140/nistec", "%\f\a\x051\x92\x01*\r\x14"},
-	{"crypto/internal/fips140/nistec/fiat", "%\x136\x92\x01"},
-	{"crypto/internal/fips140/pbkdf2", "\x03\x1d\x05\t\x06:\x15"},
-	{"crypto/internal/fips140/rsa", "\x03\x1d\x04\x01\x02\r\x01\x01\x026\x15nF"},
-	{"crypto/internal/fips140/sha256", "\x03\x1d\x1d\x01\x06*\x15}"},
-	{"crypto/internal/fips140/sha3", "\x03\x1d\x18\x05\x010\x92\x01K"},
-	{"crypto/internal/fips140/sha512", "\x03\x1d\x1d\x01\x06*\x15}"},
-	{"crypto/internal/fips140/ssh", "%^"},
-	{"crypto/internal/fips140/subtle", "#\x1a\xc3\x01"},
-	{"crypto/internal/fips140/tls12", "\x03\x1d\x05\t\x06\x028\x15"},
-	{"crypto/internal/fips140/tls13", "\x03\x1d\x05\b\a\t1\x15"},
-	{"crypto/internal/fips140cache", "\xaa\x02\r&"},
+	{"crypto/internal/constanttime", ""},
+	{"crypto/internal/cryptotest", "\x03\r\n\b%\x0e\x19\x06\x12\x12 \x04\x06\t\x18\x01\x11\x11\x1b\x01\a\x05\b\x03\x05\v"},
+	{"crypto/internal/entropy", "I"},
+	{"crypto/internal/entropy/v1.0.0", "B/\x93\x018\x13"},
+	{"crypto/internal/fips140", "A0\xbd\x01\v\x16"},
+	{"crypto/internal/fips140/aes", "\x03\x1f\x03\x02\x13\x05\x01\x01\x06*\x93\x014"},
+	{"crypto/internal/fips140/aes/gcm", "\"\x01\x02\x02\x02\x11\x05\x01\a*\x90\x01"},
+	{"crypto/internal/fips140/alias", "\xcf\x02"},
+	{"crypto/internal/fips140/bigmod", "'\x18\x01\a*\x93\x01"},
+	{"crypto/internal/fips140/check", "\"\x0e\x06\t\x02\xb4\x01Z"},
+	{"crypto/internal/fips140/check/checktest", "'\x87\x02!"},
+	{"crypto/internal/fips140/drbg", "\x03\x1e\x01\x01\x04\x13\x05\t\x01(\x84\x01\x0f7\x01"},
+	{"crypto/internal/fips140/ecdh", "\x03\x1f\x05\x02\t\r2\x84\x01\x0f7"},
+	{"crypto/internal/fips140/ecdsa", "\x03\x1f\x04\x01\x02\a\x02\x069\x15oF"},
+	{"crypto/internal/fips140/ed25519", "\x03\x1f\x05\x02\x04\v9\xc7\x01\x03"},
+	{"crypto/internal/fips140/edwards25519", "\x1e\t\a\x112\x93\x017"},
+	{"crypto/internal/fips140/edwards25519/field", "'\x13\x052\x93\x01"},
+	{"crypto/internal/fips140/hkdf", "\x03\x1f\x05\t\x06;\x15"},
+	{"crypto/internal/fips140/hmac", "\x03\x1f\x14\x01\x019\x15"},
+	{"crypto/internal/fips140/mlkem", "\x03\x1f\x05\x02\x0e\x03\x052\xca\x01"},
+	{"crypto/internal/fips140/nistec", "\x1e\t\f\f2\x93\x01*\r\x14"},
+	{"crypto/internal/fips140/nistec/fiat", "'\x137\x93\x01"},
+	{"crypto/internal/fips140/pbkdf2", "\x03\x1f\x05\t\x06;\x15"},
+	{"crypto/internal/fips140/rsa", "\x03\x1b\x04\x04\x01\x02\r\x01\x01\x027\x15oF"},
+	{"crypto/internal/fips140/sha256", "\x03\x1f\x1d\x01\a*\x15~"},
+	{"crypto/internal/fips140/sha3", "\x03\x1f\x18\x05\x011\x93\x01K"},
+	{"crypto/internal/fips140/sha512", "\x03\x1f\x1d\x01\a*\x15~"},
+	{"crypto/internal/fips140/ssh", "'_"},
+	{"crypto/internal/fips140/subtle", "\x1e\a\x1a\xc5\x01"},
+	{"crypto/internal/fips140/tls12", "\x03\x1f\x05\t\x06\x029\x15"},
+	{"crypto/internal/fips140/tls13", "\x03\x1f\x05\b\a\t2\x15"},
+	{"crypto/internal/fips140cache", "\xae\x02\r&"},
 	{"crypto/internal/fips140deps", ""},
-	{"crypto/internal/fips140deps/byteorder", "\x99\x01"},
-	{"crypto/internal/fips140deps/cpu", "\xae\x01\a"},
-	{"crypto/internal/fips140deps/godebug", "\xb6\x01"},
-	{"crypto/internal/fips140hash", "5\x1b3\xc8\x01"},
-	{"crypto/internal/fips140only", "'\r\x01\x01M3;"},
+	{"crypto/internal/fips140deps/byteorder", "\x9c\x01"},
+	{"crypto/internal/fips140deps/cpu", "\xb1\x01\a"},
+	{"crypto/internal/fips140deps/godebug", "\xb9\x01"},
+	{"crypto/internal/fips140deps/time", "\xc9\x02"},
+	{"crypto/internal/fips140hash", "7\x1c3\xc9\x01"},
+	{"crypto/internal/fips140only", ")\r\x01\x01N3<"},
 	{"crypto/internal/fips140test", ""},
-	{"crypto/internal/hpke", "\x0e\x01\x01\x03\x053#+gM"},
-	{"crypto/internal/impl", "\xb5\x02"},
-	{"crypto/internal/randutil", "\xf1\x01\x12"},
-	{"crypto/internal/sysrand", "nn! \r\r\x01\x01\f\x06"},
-	{"crypto/internal/sysrand/internal/seccomp", "n"},
-	{"crypto/md5", "\x0e3-\x15\x16g"},
-	{"crypto/mlkem", "/"},
-	{"crypto/pbkdf2", "2\x0e\x01-\x15"},
-	{"crypto/rand", "\x1a\x06\a\x1a\x04\x01(\x83\x01\rM"},
-	{"crypto/rc4", "#\x1e-\xc6\x01"},
-	{"crypto/rsa", "\x0e\f\x01\t\x0f\r\x01\x04\x06\a\x1c\x03\x123;\f\x01"},
-	{"crypto/sha1", "\x0e\f'\x03*\x15\x16\x15R"},
-	{"crypto/sha256", "\x0e\f\x1aO"},
-	{"crypto/sha3", "\x0e'N\xc8\x01"},
-	{"crypto/sha512", "\x0e\f\x1cM"},
-	{"crypto/subtle", "8\x9b\x01W"},
-	{"crypto/tls", "\x03\b\x02\x01\x01\x01\x01\x02\x01\x01\x01\x02\x01\x01\a\x01\r\n\x01\t\x05\x03\x01\x01\x01\x01\x02\x01\x02\x01\x17\x02\x03\x12\x16\x15\b;\x16\x16\r\b\x01\x01\x01\x02\x01\r\x06\x02\x01\x0f"},
-	{"crypto/tls/internal/fips140tls", "\x17\xa1\x02"},
-	{"crypto/x509", "\x03\v\x01\x01\x01\x01\x01\x01\x01\x012\x05\x01\x01\x02\x05\x0e\x06\x02\x02\x03E\x038\x01\x02\b\x01\x01\x02\a\x10\x05\x01\x06\x02\x05\n\x01\x02\x0e\x02\x01\x01\x02\x03\x01"},
-	{"crypto/x509/pkix", "d\x06\a\x8d\x01G"},
-	{"database/sql", "\x03\nK\x16\x03\x80\x01\v\a\"\x05\b\x02\x03\x01\r\x02\x02\x02"},
-	{"database/sql/driver", "\ra\x03\xb4\x01\x0f\x11"},
-	{"debug/buildinfo", "\x03X\x02\x01\x01\b\a\x03e\x19\x02\x01+\x0f\x1f"},
-	{"debug/dwarf", "\x03d\a\x03\x80\x011\x11\x01\x01"},
-	{"debug/elf", "\x03\x06Q\r\a\x03e\x1a\x01,\x17\x01\x16"},
-	{"debug/gosym", "\x03d\n\xc2\x01\x01\x01\x02"},
-	{"debug/macho", "\x03\x06Q\r\ne\x1b,\x17\x01"},
-	{"debug/pe", "\x03\x06Q\r\a\x03e\x1b,\x17\x01\x16"},
-	{"debug/plan9obj", "g\a\x03e\x1b,"},
-	{"embed", "n*@\x19\x01S"},
+	{"crypto/internal/hpke", "\x0e\x01\x01\x03\x056#+hM"},
+	{"crypto/internal/impl", "\xb9\x02"},
+	{"crypto/internal/randutil", "\xf5\x01\x12"},
+	{"crypto/internal/sysrand", "qo! \r\r\x01\x01\f\x06"},
+	{"crypto/internal/sysrand/internal/seccomp", "q"},
+	{"crypto/md5", "\x0e6-\x15\x16h"},
+	{"crypto/mlkem", "1"},
+	{"crypto/pbkdf2", "4\x0f\x01-\x15"},
+	{"crypto/rand", "\x1a\b\a\x1b\x04\x01(\x84\x01\rM"},
+	{"crypto/rc4", "%\x1f-\xc7\x01"},
+	{"crypto/rsa", "\x0e\f\x01\v\x0f\x0e\x01\x04\x06\a\x1c\x03\x123<\f\x01"},
+	{"crypto/sha1", "\x0e\f*\x03*\x15\x16\x15S"},
+	{"crypto/sha256", "\x0e\f\x1cP"},
+	{"crypto/sha3", "\x0e)O\xc9\x01"},
+	{"crypto/sha512", "\x0e\f\x1eN"},
+	{"crypto/subtle", "\x1e\x1c\x9c\x01X"},
+	{"crypto/tls", "\x03\b\x02\x01\x01\x01\x01\x02\x01\x01\x01\x02\x01\x01\t\x01\r\n\x01\n\x05\x03\x01\x01\x01\x01\x02\x01\x02\x01\x17\x02\x03\x12\x16\x15\b<\x16\x16\r\b\x01\x01\x01\x02\x01\r\x06\x02\x01\x0f"},
+	{"crypto/tls/internal/fips140tls", "\x17\xa5\x02"},
+	{"crypto/x509", "\x03\v\x01\x01\x01\x01\x01\x01\x01\x015\x05\x01\x01\x02\x05\x0e\x06\x02\x02\x03E\x039\x01\x02\b\x01\x01\x02\a\x10\x05\x01\x06\x02\x05\b\x02\x01\x02\x0e\x02\x01\x01\x02\x03\x01"},
+	{"crypto/x509/pkix", "g\x06\a\x8e\x01G"},
+	{"database/sql", "\x03\nN\x16\x03\x81\x01\v\a\"\x05\b\x02\x03\x01\r\x02\x02\x02"},
+	{"database/sql/driver", "\rd\x03\xb5\x01\x0f\x11"},
+	{"debug/buildinfo", "\x03[\x02\x01\x01\b\a\x03e\x1a\x02\x01+\x0f\x1f"},
+	{"debug/dwarf", "\x03g\a\x03\x81\x011\x11\x01\x01"},
+	{"debug/elf", "\x03\x06T\r\a\x03e\x1b\x01\f \x17\x01\x16"},
+	{"debug/gosym", "\x03g\n\xc3\x01\x01\x01\x02"},
+	{"debug/macho", "\x03\x06T\r\ne\x1c,\x17\x01"},
+	{"debug/pe", "\x03\x06T\r\a\x03e\x1c,\x17\x01\x16"},
+	{"debug/plan9obj", "j\a\x03e\x1c,"},
+	{"embed", "q*A\x19\x01S"},
 	{"embed/internal/embedtest", ""},
 	{"encoding", ""},
-	{"encoding/ascii85", "\xf1\x01C"},
-	{"encoding/asn1", "\x03k\x03\x8c\x01\x01'\r\x02\x01\x10\x03\x01"},
-	{"encoding/base32", "\xf1\x01A\x02"},
-	{"encoding/base64", "\x99\x01XA\x02"},
-	{"encoding/binary", "n\x83\x01\f(\r\x05"},
-	{"encoding/csv", "\x02\x01k\x03\x80\x01D\x12\x02"},
-	{"encoding/gob", "\x02`\x05\a\x03e\x1b\v\x01\x03\x1d\b\x12\x01\x0f\x02"},
-	{"encoding/hex", "n\x03\x80\x01A\x03"},
-	{"encoding/json", "\x03\x01^\x04\b\x03\x80\x01\f(\r\x02\x01\x02\x10\x01\x01\x02"},
-	{"encoding/pem", "\x03c\b\x83\x01A\x03"},
-	{"encoding/xml", "\x02\x01_\f\x03\x80\x014\x05\n\x01\x02\x10\x02"},
-	{"errors", "\xca\x01\x81\x01"},
-	{"expvar", "kK?\b\v\x15\r\b\x02\x03\x01\x11"},
-	{"flag", "b\f\x03\x80\x01,\b\x05\b\x02\x01\x10"},
-	{"fmt", "nE>\f \b\r\x02\x03\x12"},
-	{"go/ast", "\x03\x01m\x0e\x01q\x03)\b\r\x02\x01"},
-	{"go/build", "\x02\x01k\x03\x01\x02\x02\a\x02\x01\x17\x1f\x04\x02\t\x19\x13\x01+\x01\x04\x01\a\b\x02\x01\x12\x02\x02"},
-	{"go/build/constraint", "n\xc6\x01\x01\x12\x02"},
-	{"go/constant", "q\x0f}\x01\x024\x01\x02\x12"},
-	{"go/doc", "\x04m\x01\x05\t>31\x10\x02\x01\x12\x02"},
-	{"go/doc/comment", "\x03n\xc1\x01\x01\x01\x01\x12\x02"},
-	{"go/format", "\x03n\x01\v\x01\x02qD"},
-	{"go/importer", "s\a\x01\x01\x04\x01p9"},
-	{"go/internal/gccgoimporter", "\x02\x01X\x13\x03\x04\v\x01n\x02,\x01\x05\x11\x01\f\b"},
-	{"go/internal/gcimporter", "\x02o\x0f\x010\x05\x0e-,\x15\x03\x02"},
-	{"go/internal/srcimporter", "q\x01\x01\n\x03\x01p,\x01\x05\x12\x02\x14"},
-	{"go/parser", "\x03k\x03\x01\x02\v\x01q\x01+\x06\x12"},
-	{"go/printer", "q\x01\x02\x03\tq\f \x15\x02\x01\x02\v\x05\x02"},
-	{"go/scanner", "\x03n\x0fq2\x10\x01\x13\x02"},
-	{"go/token", "\x04m\x83\x01>\x02\x03\x01\x0f\x02"},
-	{"go/types", "\x03\x01\x06d\x03\x01\x03\b\x03\x02\x15\x1f\x061\x04\x03\t \x06\a\b\x01\x01\x01\x02\x01\x0f\x02\x02"},
-	{"go/version", "\xbb\x01z"},
-	{"hash", "\xf1\x01"},
-	{"hash/adler32", "n\x15\x16"},
-	{"hash/crc32", "n\x15\x16\x15\x89\x01\x01\x13"},
-	{"hash/crc64", "n\x15\x16\x9e\x01"},
-	{"hash/fnv", "n\x15\x16g"},
-	{"hash/maphash", "\x83\x01\x11!\x03\x93\x01"},
-	{"html", "\xb5\x02\x02\x12"},
-	{"html/template", "\x03h\x06\x18-;\x01\n!\x05\x01\x02\x03\f\x01\x02\f\x01\x03\x02"},
-	{"image", "\x02l\x1ee\x0f4\x03\x01"},
+	{"encoding/ascii85", "\xf5\x01C"},
+	{"encoding/asn1", "\x03n\x03e(\x01'\r\x02\x01\x10\x03\x01"},
+	{"encoding/base32", "\xf5\x01A\x02"},
+	{"encoding/base64", "\x9c\x01YA\x02"},
+	{"encoding/binary", "q\x84\x01\f(\r\x05"},
+	{"encoding/csv", "\x02\x01n\x03\x81\x01D\x12\x02"},
+	{"encoding/gob", "\x02c\x05\a\x03e\x1c\v\x01\x03\x1d\b\x12\x01\x0f\x02"},
+	{"encoding/hex", "q\x03\x81\x01A\x03"},
+	{"encoding/json", "\x03\x01a\x04\b\x03\x81\x01\f(\r\x02\x01\x02\x10\x01\x01\x02"},
+	{"encoding/pem", "\x03f\b\x84\x01A\x03"},
+	{"encoding/xml", "\x02\x01b\f\x03\x81\x014\x05\n\x01\x02\x10\x02"},
+	{"errors", "\xcc\x01\x83\x01"},
+	{"expvar", "nK@\b\v\x15\r\b\x02\x03\x01\x11"},
+	{"flag", "e\f\x03\x81\x01,\b\x05\b\x02\x01\x10"},
+	{"fmt", "qE&\x19\f \b\r\x02\x03\x12"},
+	{"go/ast", "\x03\x01p\x0e\x01r\x03)\b\r\x02\x01\x12\x02"},
+	{"go/build", "\x02\x01n\x03\x01\x02\x02\a\x02\x01\x17\x1f\x04\x02\b\x1b\x13\x01+\x01\x04\x01\a\b\x02\x01\x12\x02\x02"},
+	{"go/build/constraint", "q\xc7\x01\x01\x12\x02"},
+	{"go/constant", "t\x0f~\x01\x024\x01\x02\x12"},
+	{"go/doc", "\x04p\x01\x05\t=51\x10\x02\x01\x12\x02"},
+	{"go/doc/comment", "\x03q\xc2\x01\x01\x01\x01\x12\x02"},
+	{"go/format", "\x03q\x01\v\x01\x02rD"},
+	{"go/importer", "v\a\x01\x01\x04\x01q9"},
+	{"go/internal/gccgoimporter", "\x02\x01[\x13\x03\x04\v\x01o\x02,\x01\x05\x11\x01\f\b"},
+	{"go/internal/gcimporter", "\x02r\x0f\x010\x05\r/,\x15\x03\x02"},
+	{"go/internal/srcimporter", "t\x01\x01\n\x03\x01q,\x01\x05\x12\x02\x14"},
+	{"go/parser", "\x03n\x03\x01\x02\v\x01r\x01+\x06\x12"},
+	{"go/printer", "t\x01\x02\x03\tr\f \x15\x02\x01\x02\v\x05\x02"},
+	{"go/scanner", "\x03q\x0fr2\x10\x01\x13\x02"},
+	{"go/token", "\x04p\x84\x01>\x02\x03\x01\x0f\x02"},
+	{"go/types", "\x03\x01\x06g\x03\x01\x03\b\x03\x024\x062\x04\x03\t \x06\a\b\x01\x01\x01\x02\x01\x0f\x02\x02"},
+	{"go/version", "\xbe\x01{"},
+	{"hash", "\xf5\x01"},
+	{"hash/adler32", "q\x15\x16"},
+	{"hash/crc32", "q\x15\x16\x15\x8a\x01\x01\x13"},
+	{"hash/crc64", "q\x15\x16\x9f\x01"},
+	{"hash/fnv", "q\x15\x16h"},
+	{"hash/maphash", "\x86\x01\x11<|"},
+	{"html", "\xb9\x02\x02\x12"},
+	{"html/template", "\x03k\x06\x18-<\x01\n!\x05\x01\x02\x03\f\x01\x02\f\x01\x03\x02"},
+	{"image", "\x02o\x1ef\x0f4\x03\x01"},
 	{"image/color", ""},
-	{"image/color/palette", "\x8c\x01"},
-	{"image/draw", "\x8b\x01\x01\x04"},
-	{"image/gif", "\x02\x01\x05f\x03\x1a\x01\x01\x01\vX"},
-	{"image/internal/imageutil", "\x8b\x01"},
-	{"image/jpeg", "\x02l\x1d\x01\x04a"},
-	{"image/png", "\x02\a^\n\x12\x02\x06\x01eC"},
-	{"index/suffixarray", "\x03d\a\x83\x01\f+\n\x01"},
-	{"internal/abi", "\xb5\x01\x96\x01"},
-	{"internal/asan", "\xcb\x02"},
-	{"internal/bisect", "\xaa\x02\r\x01"},
-	{"internal/buildcfg", "qGe\x06\x02\x05\n\x01"},
-	{"internal/bytealg", "\xae\x01\x9d\x01"},
+	{"image/color/palette", "\x8f\x01"},
+	{"image/draw", "\x8e\x01\x01\x04"},
+	{"image/gif", "\x02\x01\x05i\x03\x1a\x01\x01\x01\vY"},
+	{"image/internal/imageutil", "\x8e\x01"},
+	{"image/jpeg", "\x02o\x1d\x01\x04b"},
+	{"image/png", "\x02\aa\n\x12\x02\x06\x01fC"},
+	{"index/suffixarray", "\x03g\a\x84\x01\f+\n\x01"},
+	{"internal/abi", "\xb8\x01\x97\x01"},
+	{"internal/asan", "\xcf\x02"},
+	{"internal/bisect", "\xae\x02\r\x01"},
+	{"internal/buildcfg", "tGf\x06\x02\x05\n\x01"},
+	{"internal/bytealg", "\xb1\x01\x9e\x01"},
 	{"internal/byteorder", ""},
 	{"internal/cfg", ""},
-	{"internal/cgrouptest", "q[Q\x06\x0f\x02\x01\x04\x01"},
-	{"internal/chacha8rand", "\x99\x01\x15\a\x96\x01"},
+	{"internal/cgrouptest", "tZS\x06\x0f\x02\x01\x04\x01"},
+	{"internal/chacha8rand", "\x9c\x01\x15\a\x97\x01"},
 	{"internal/copyright", ""},
 	{"internal/coverage", ""},
 	{"internal/coverage/calloc", ""},
-	{"internal/coverage/cfile", "k\x06\x16\x17\x01\x02\x01\x01\x01\x01\x01\x01\x01#\x02$,\x06\a\n\x01\x03\r\x06"},
-	{"internal/coverage/cformat", "\x04m-\x04O\v6\x01\x02\r"},
-	{"internal/coverage/cmerge", "q-_"},
-	{"internal/coverage/decodecounter", "g\n-\v\x02F,\x17\x17"},
-	{"internal/coverage/decodemeta", "\x02e\n\x16\x17\v\x02F,"},
-	{"internal/coverage/encodecounter", "\x02e\n-\f\x01\x02D\v!\x15"},
-	{"internal/coverage/encodemeta", "\x02\x01d\n\x12\x04\x17\r\x02D,."},
-	{"internal/coverage/pods", "\x04m-\x7f\x06\x05\n\x02\x01"},
-	{"internal/coverage/rtcov", "\xcb\x02"},
-	{"internal/coverage/slicereader", "g\n\x80\x01Z"},
-	{"internal/coverage/slicewriter", "q\x80\x01"},
-	{"internal/coverage/stringtab", "q8\x04D"},
+	{"internal/coverage/cfile", "n\x06\x16\x17\x01\x02\x01\x01\x01\x01\x01\x01\x01\"\x02&,\x06\a\n\x01\x03\r\x06"},
+	{"internal/coverage/cformat", "\x04p-\x04P\v6\x01\x02\r"},
+	{"internal/coverage/cmerge", "t-`"},
+	{"internal/coverage/decodecounter", "j\n-\v\x02G,\x17\x17"},
+	{"internal/coverage/decodemeta", "\x02h\n\x16\x17\v\x02G,"},
+	{"internal/coverage/encodecounter", "\x02h\n-\f\x01\x02E\v!\x15"},
+	{"internal/coverage/encodemeta", "\x02\x01g\n\x12\x04\x17\r\x02E,."},
+	{"internal/coverage/pods", "\x04p-\x80\x01\x06\x05\n\x02\x01"},
+	{"internal/coverage/rtcov", "\xcf\x02"},
+	{"internal/coverage/slicereader", "j\n\x81\x01Z"},
+	{"internal/coverage/slicewriter", "t\x81\x01"},
+	{"internal/coverage/stringtab", "t8\x04E"},
 	{"internal/coverage/test", ""},
 	{"internal/coverage/uleb128", ""},
-	{"internal/cpu", "\xcb\x02"},
-	{"internal/dag", "\x04m\xc1\x01\x03"},
-	{"internal/diff", "\x03n\xc2\x01\x02"},
-	{"internal/exportdata", "\x02\x01k\x03\x02c\x1b,\x01\x05\x11\x01\x02"},
-	{"internal/filepathlite", "n*@\x1a@"},
-	{"internal/fmtsort", "\x04\xa1\x02\r"},
-	{"internal/fuzz", "\x03\nB\x18\x04\x03\x03\x01\v\x036;\f\x03\x1d\x01\x05\x02\x05\n\x01\x02\x01\x01\f\x04\x02"},
+	{"internal/cpu", "\xcf\x02"},
+	{"internal/dag", "\x04p\xc2\x01\x03"},
+	{"internal/diff", "\x03q\xc3\x01\x02"},
+	{"internal/exportdata", "\x02\x01n\x03\x02c\x1c,\x01\x05\x11\x01\x02"},
+	{"internal/filepathlite", "q*A\x1a@"},
+	{"internal/fmtsort", "\x04\xa5\x02\r"},
+	{"internal/fuzz", "\x03\nE\x18\x04\x03\x03\x01\v\x036<\f\x03\x1d\x01\x05\x02\x05\n\x01\x02\x01\x01\f\x04\x02"},
 	{"internal/goarch", ""},
-	{"internal/godebug", "\x96\x01!\x80\x01\x01\x13"},
+	{"internal/godebug", "\x99\x01!\x81\x01\x01\x13"},
 	{"internal/godebugs", ""},
 	{"internal/goexperiment", ""},
 	{"internal/goos", ""},
-	{"internal/goroot", "\x9d\x02\x01\x05\x12\x02"},
+	{"internal/goroot", "\xa1\x02\x01\x05\x12\x02"},
 	{"internal/gover", "\x04"},
 	{"internal/goversion", ""},
-	{"internal/itoa", ""},
-	{"internal/lazyregexp", "\x9d\x02\v\r\x02"},
-	{"internal/lazytemplate", "\xf1\x01,\x18\x02\f"},
-	{"internal/msan", "\xcb\x02"},
+	{"internal/lazyregexp", "\xa1\x02\v\r\x02"},
+	{"internal/lazytemplate", "\xf5\x01,\x18\x02\f"},
+	{"internal/msan", "\xcf\x02"},
 	{"internal/nettrace", ""},
-	{"internal/obscuretestdata", "f\x8b\x01,"},
-	{"internal/oserror", "n"},
-	{"internal/pkgbits", "\x03L\x18\a\x03\x04\vq\r\x1f\r\n\x01"},
+	{"internal/obscuretestdata", "i\x8c\x01,"},
+	{"internal/oserror", "q"},
+	{"internal/pkgbits", "\x03O\x18\a\x03\x04\vr\r\x1f\r\n\x01"},
 	{"internal/platform", ""},
-	{"internal/poll", "nO\x1f\x159\r\x01\x01\f\x06"},
-	{"internal/profile", "\x03\x04g\x03\x80\x017\v\x01\x01\x10"},
+	{"internal/poll", "qj\x05\x159\r\x01\x01\f\x06"},
+	{"internal/profile", "\x03\x04j\x03\x81\x017\n\x01\x01\x01\x10"},
 	{"internal/profilerecord", ""},
-	{"internal/race", "\x94\x01\xb7\x01"},
-	{"internal/reflectlite", "\x94\x01!9<!"},
-	{"internal/runtime/atomic", "\xb5\x01\x96\x01"},
-	{"internal/runtime/cgroup", "\x98\x01:\x02w"},
-	{"internal/runtime/exithook", "\xcb\x01\x80\x01"},
-	{"internal/runtime/gc", "\xb5\x01"},
-	{"internal/runtime/maps", "\x94\x01\x01 \v\t\a\x03x"},
-	{"internal/runtime/math", "\xb5\x01"},
+	{"internal/race", "\x97\x01\xb8\x01"},
+	{"internal/reflectlite", "\x97\x01!:<!"},
+	{"internal/runtime/atomic", "\xb8\x01\x97\x01"},
+	{"internal/runtime/cgroup", "\x9b\x01<\x04t"},
+	{"internal/runtime/exithook", "\xcd\x01\x82\x01"},
+	{"internal/runtime/gc", "\xb8\x01"},
+	{"internal/runtime/gc/internal/gen", "\n`\n\x17j\x04\v\x1d\b\x10\x02"},
+	{"internal/runtime/gc/scan", "\xb1\x01\a\x18\x06y"},
+	{"internal/runtime/maps", "\x97\x01\x01 \n\t\t\x02y"},
+	{"internal/runtime/math", "\xb8\x01"},
 	{"internal/runtime/startlinetest", ""},
-	{"internal/runtime/strconv", "\xd0\x01"},
-	{"internal/runtime/sys", "\xb5\x01\x04"},
-	{"internal/runtime/syscall", "\xb5\x01\x96\x01"},
+	{"internal/runtime/sys", "\xb8\x01\x04"},
+	{"internal/runtime/syscall/linux", "\xb8\x01\x97\x01"},
 	{"internal/runtime/wasitest", ""},
-	{"internal/saferio", "\xf1\x01Z"},
-	{"internal/singleflight", "\xb7\x02"},
-	{"internal/stringslite", "\x98\x01\xb3\x01"},
-	{"internal/sync", "\x94\x01!\x14o\x13"},
-	{"internal/synctest", "\x94\x01\xb7\x01"},
-	{"internal/syscall/execenv", "\xb9\x02"},
-	{"internal/syscall/unix", "\xaa\x02\x0e\x01\x12"},
-	{"internal/sysinfo", "\x02\x01\xab\x01C,\x18\x02"},
+	{"internal/saferio", "\xf5\x01Z"},
+	{"internal/singleflight", "\xbb\x02"},
+	{"internal/strconv", "\x84\x02K"},
+	{"internal/stringslite", "\x9b\x01\xb4\x01"},
+	{"internal/sync", "\x97\x01!\x13q\x13"},
+	{"internal/synctest", "\x97\x01\xb8\x01"},
+	{"internal/syscall/execenv", "\xbd\x02"},
+	{"internal/syscall/unix", "\xae\x02\x0e\x01\x12"},
+	{"internal/sysinfo", "\x02\x01\xae\x01D,\x18\x02"},
 	{"internal/syslist", ""},
-	{"internal/testenv", "\x03\na\x02\x01)\x1b\x10-+\x01\x05\a\n\x01\x02\x02\x01\v"},
-	{"internal/testhash", "\x03\x80\x01n\x118\v"},
-	{"internal/testlog", "\xb7\x02\x01\x13"},
-	{"internal/testpty", "n\x03\xac\x01"},
-	{"internal/trace", "\x02\x01\x01\x06]\a\x03t\x03\x03\x06\x03\t5\x01\x01\x01\x10\x06"},
-	{"internal/trace/internal/testgen", "\x03d\nr\x03\x02\x03\x011\v\r\x10"},
-	{"internal/trace/internal/tracev1", "\x03\x01c\a\x03z\x06\f5\x01"},
-	{"internal/trace/raw", "\x02e\nw\x03\x06C\x01\x12"},
-	{"internal/trace/testtrace", "\x02\x01k\x03r\x03\x05\x01\x057\n\x02\x01"},
+	{"internal/testenv", "\x03\nd\x02\x01)\x1b\x0f/+\x01\x05\a\n\x01\x02\x02\x01\v"},
+	{"internal/testhash", "\x03\x83\x01o\x118\v"},
+	{"internal/testlog", "\xbb\x02\x01\x13"},
+	{"internal/testpty", "q\x03\xad\x01"},
+	{"internal/trace", "\x02\x01\x01\x06`\a\x03u\x03\x03\x06\x03\t5\x01\x01\x01\x10\x06"},
+	{"internal/trace/internal/testgen", "\x03g\ns\x03\x02\x03\x011\v\r\x10"},
+	{"internal/trace/internal/tracev1", "\x03\x01f\a\x03{\x06\f5\x01"},
+	{"internal/trace/raw", "\x02h\nx\x03\x06C\x01\x12"},
+	{"internal/trace/testtrace", "\x02\x01n\x03o\x04\x03\x05\x01\x05,\v\x02\b\x02\x01\x05"},
 	{"internal/trace/tracev2", ""},
-	{"internal/trace/traceviewer", "\x02^\v\x06\x19=\x1c\a\a\x04\b\v\x15\x01\x05\a\n\x01\x02\x0e"},
+	{"internal/trace/traceviewer", "\x02a\v\x06\x19<\x1e\a\a\x04\b\v\x15\x01\x05\a\n\x01\x02\x0e"},
 	{"internal/trace/traceviewer/format", ""},
-	{"internal/trace/version", "qw\t"},
-	{"internal/txtar", "\x03n\xac\x01\x18"},
-	{"internal/types/errors", "\xb4\x02"},
-	{"internal/unsafeheader", "\xcb\x02"},
-	{"internal/xcoff", "Z\r\a\x03e\x1b,\x17\x01"},
-	{"internal/zstd", "g\a\x03\x80\x01\x0f"},
-	{"io", "n\xc9\x01"},
-	{"io/fs", "n*+.1\x10\x13\x04"},
-	{"io/ioutil", "\xf1\x01\x01+\x15\x03"},
-	{"iter", "\xc9\x01a!"},
-	{"log", "q\x80\x01\x05'\r\r\x01\r"},
+	{"internal/trace/version", "tx\t"},
+	{"internal/txtar", "\x03q\xad\x01\x18"},
+	{"internal/types/errors", "\xb8\x02"},
+	{"internal/unsafeheader", "\xcf\x02"},
+	{"internal/xcoff", "]\r\a\x03e\x1c,\x17\x01"},
+	{"internal/zstd", "j\a\x03\x81\x01\x0f"},
+	{"io", "q\xca\x01"},
+	{"io/fs", "q**01\x10\x13\x04"},
+	{"io/ioutil", "\xf5\x01\x01+\x15\x03"},
+	{"iter", "\xcb\x01c!"},
+	{"log", "t\x81\x01\x05'\r\r\x01\r"},
 	{"log/internal", ""},
-	{"log/slog", "\x03\nU\t\x03\x03\x80\x01\x04\x01\x02\x02\x03(\x05\b\x02\x01\x02\x01\r\x02\x02\x02"},
+	{"log/slog", "\x03\nX\t\x03\x03\x81\x01\x04\x01\x02\x02\x03(\x05\b\x02\x01\x02\x01\r\x02\x02\x02"},
 	{"log/slog/internal", ""},
-	{"log/slog/internal/benchmarks", "\ra\x03\x80\x01\x06\x03:\x11"},
-	{"log/slog/internal/buffer", "\xb7\x02"},
-	{"log/syslog", "n\x03\x84\x01\x12\x16\x18\x02\x0e"},
-	{"maps", "\xf4\x01W"},
-	{"math", "\xae\x01RK"},
-	{"math/big", "\x03k\x03(\x15C\f\x03\x020\x02\x01\x02\x14"},
-	{"math/big/internal/asmgen", "\x03\x01m\x8f\x012\x03"},
-	{"math/bits", "\xcb\x02"},
-	{"math/cmplx", "\xfd\x01\x03"},
-	{"math/rand", "\xb6\x01G:\x01\x13"},
-	{"math/rand/v2", "n+\x03a\x03K"},
-	{"mime", "\x02\x01c\b\x03\x80\x01\v!\x15\x03\x02\x10\x02"},
-	{"mime/multipart", "\x02\x01H#\x03E;\v\x01\a\x02\x15\x02\x06\x0f\x02\x01\x16"},
-	{"mime/quotedprintable", "\x02\x01n\x80\x01"},
-	{"net", "\x04\ta*\x1e\a\x04\x05\x11\x01\x04\x15\x01%\x06\r\b\x05\x01\x01\f\x06\a"},
-	{"net/http", "\x02\x01\x04\x04\x02>\b\x13\x01\a\x03E;\x01\x03\a\x01\x03\x02\x02\x01\x02\x06\x02\x01\x01\n\x01\x01\x05\x01\x02\x05\b\x01\x01\x01\x02\x01\r\x02\x02\x02\b\x01\x01\x01"},
-	{"net/http/cgi", "\x02Q\x1b\x03\x80\x01\x04\a\v\x01\x13\x01\x01\x01\x04\x01\x05\x02\b\x02\x01\x10\x0e"},
-	{"net/http/cookiejar", "\x04j\x03\x96\x01\x01\b\f\x16\x03\x02\x0e\x04"},
-	{"net/http/fcgi", "\x02\x01\nZ\a\x03\x80\x01\x16\x01\x01\x14\x18\x02\x0e"},
-	{"net/http/httptest", "\x02\x01\nF\x02\x1b\x01\x80\x01\x04\x12\x01\n\t\x02\x17\x01\x02\x0e\x0e"},
-	{"net/http/httptrace", "\rFnF\x14\n "},
-	{"net/http/httputil", "\x02\x01\na\x03\x80\x01\x04\x0f\x03\x01\x05\x02\x01\v\x01\x19\x02\x0e\x0e"},
-	{"net/http/internal", "\x02\x01k\x03\x80\x01"},
-	{"net/http/internal/ascii", "\xb5\x02\x12"},
-	{"net/http/internal/httpcommon", "\ra\x03\x9c\x01\x0e\x01\x17\x01\x01\x02\x1c\x02"},
-	{"net/http/internal/testcert", "\xb5\x02"},
-	{"net/http/pprof", "\x02\x01\nd\x18-\x11*\x04\x13\x14\x01\r\x04\x03\x01\x02\x01\x10"},
+	{"log/slog/internal/benchmarks", "\rd\x03\x81\x01\x06\x03:\x11"},
+	{"log/slog/internal/buffer", "\xbb\x02"},
+	{"log/syslog", "q\x03\x85\x01\x12\x16\x18\x02\x0e"},
+	{"maps", "\xf8\x01W"},
+	{"math", "\xb1\x01SK"},
+	{"math/big", "\x03n\x03(\x15D\f\x03\x020\x02\x01\x02\x14"},
+	{"math/big/internal/asmgen", "\x03\x01p\x90\x012\x03"},
+	{"math/bits", "\xcf\x02"},
+	{"math/cmplx", "\x81\x02\x03"},
+	{"math/rand", "\xb9\x01H:\x01\x13"},
+	{"math/rand/v2", "q+\x03b\x03K"},
+	{"mime", "\x02\x01f\b\x03\x81\x01\v!\x15\x03\x02\x10\x02"},
+	{"mime/multipart", "\x02\x01K#\x03E<\v\x01\a\x02\x15\x02\x06\x0f\x02\x01\x16"},
+	{"mime/quotedprintable", "\x02\x01q\x81\x01"},
+	{"net", "\x04\td*\x1e\n\x05\x12\x01\x01\x04\x15\x01%\x06\r\b\x05\x01\x01\f\x06\a"},
+	{"net/http", "\x02\x01\x03\x01\x04\x02A\b\x13\x01\a\x03E<\x01\x03\a\x01\x03\x02\x02\x01\x02\x06\x02\x01\x01\n\x01\x01\x05\x01\x02\x05\b\x01\x01\x01\x02\x01\r\x02\x02\x02\b\x01\x01\x01"},
+	{"net/http/cgi", "\x02T\x1b\x03\x81\x01\x04\a\v\x01\x13\x01\x01\x01\x04\x01\x05\x02\b\x02\x01\x10\x0e"},
+	{"net/http/cookiejar", "\x04m\x03\x97\x01\x01\b\f\x16\x03\x02\x0e\x04"},
+	{"net/http/fcgi", "\x02\x01\n]\a\x03\x81\x01\x16\x01\x01\x14\x18\x02\x0e"},
+	{"net/http/httptest", "\x02\x01\nI\x02\x1b\x01\x81\x01\x04\x12\x01\n\t\x02\x17\x01\x02\x0e\x0e"},
+	{"net/http/httptrace", "\rImH\x14\n "},
+	{"net/http/httputil", "\x02\x01\nd\x03\x81\x01\x04\x0f\x03\x01\x05\x02\x01\v\x01\x19\x02\x0e\x0e"},
+	{"net/http/internal", "\x02\x01n\x03\x81\x01"},
+	{"net/http/internal/ascii", "\xb9\x02\x12"},
+	{"net/http/internal/httpcommon", "\rd\x03\x9d\x01\x0e\x01\x17\x01\x01\x02\x1c\x02"},
+	{"net/http/internal/testcert", "\xb9\x02"},
+	{"net/http/pprof", "\x02\x01\ng\x18-\x02\x0e,\x04\x13\x14\x01\r\x04\x03\x01\x02\x01\x10"},
 	{"net/internal/cgotest", ""},
-	{"net/internal/socktest", "q\xc6\x01\x02"},
-	{"net/mail", "\x02l\x03\x80\x01\x04\x0f\x03\x14\x1a\x02\x0e\x04"},
-	{"net/netip", "\x04j*\x01$@\x034\x16"},
-	{"net/rpc", "\x02g\x05\x03\x0f\ng\x04\x12\x01\x1d\r\x03\x02"},
-	{"net/rpc/jsonrpc", "k\x03\x03\x80\x01\x16\x11\x1f"},
-	{"net/smtp", "\x19/\v\x13\b\x03\x80\x01\x16\x14\x1a"},
-	{"net/textproto", "\x02\x01k\x03\x80\x01\f\n-\x01\x02\x14"},
-	{"net/url", "n\x03\x8b\x01&\x10\x02\x01\x16"},
-	{"os", "n*\x01\x19\x03\b\t\x12\x03\x01\x05\x10\x018\b\x05\x01\x01\f\x06"},
-	{"os/exec", "\x03\naH%\x01\x15\x01+\x06\a\n\x01\x04\f"},
-	{"os/exec/internal/fdtest", "\xb9\x02"},
-	{"os/signal", "\r\x90\x02\x15\x05\x02"},
-	{"os/user", "\x02\x01k\x03\x80\x01,\r\n\x01\x02"},
-	{"path", "n*\xb1\x01"},
-	{"path/filepath", "n*\x1a@+\r\b\x03\x04\x10"},
-	{"plugin", "n"},
-	{"reflect", "n&\x04\x1d\b\f\x06\x04\x1b\x06\t-\n\x03\x10\x02\x02"},
+	{"net/internal/socktest", "t\xc7\x01\x02"},
+	{"net/mail", "\x02o\x03\x81\x01\x04\x0f\x03\x14\x1a\x02\x0e\x04"},
+	{"net/netip", "\x04m*\x01e\x034\x16"},
+	{"net/rpc", "\x02j\x05\x03\x0f\nh\x04\x12\x01\x1d\r\x03\x02"},
+	{"net/rpc/jsonrpc", "n\x03\x03\x81\x01\x16\x11\x1f"},
+	{"net/smtp", "\x192\v\x13\b\x03\x81\x01\x16\x14\x1a"},
+	{"net/textproto", "\x02\x01n\x03\x81\x01\f\n-\x01\x02\x14"},
+	{"net/url", "q\x03\xa7\x01\v\x10\x02\x01\x16"},
+	{"os", "q*\x01\x19\x03\x10\x13\x01\x03\x01\x05\x10\x018\b\x05\x01\x01\f\x06"},
+	{"os/exec", "\x03\ndH&\x01\x15\x01+\x06\a\n\x01\x04\f"},
+	{"os/exec/internal/fdtest", "\xbd\x02"},
+	{"os/signal", "\r\x94\x02\x15\x05\x02"},
+	{"os/user", "\x02\x01n\x03\x81\x01,\r\n\x01\x02"},
+	{"path", "q*\xb2\x01"},
+	{"path/filepath", "q*\x1aA+\r\b\x03\x04\x10"},
+	{"plugin", "q"},
+	{"reflect", "q&\x04\x1d\x13\b\x03\x05\x17\x06\t-\n\x03\x10\x02\x02"},
 	{"reflect/internal/example1", ""},
 	{"reflect/internal/example2", ""},
-	{"regexp", "\x03\xee\x018\t\x02\x01\x02\x10\x02"},
-	{"regexp/syntax", "\xb2\x02\x01\x01\x01\x02\x10\x02"},
-	{"runtime", "\x94\x01\x04\x01\x03\f\x06\a\x02\x01\x01\x0f\x03\x01\x01\x01\x01\x01\x02\x01\x01\x04\x10c"},
-	{"runtime/coverage", "\xa0\x01Q"},
-	{"runtime/debug", "qUW\r\b\x02\x01\x10\x06"},
-	{"runtime/metrics", "\xb7\x01F-!"},
-	{"runtime/pprof", "\x02\x01\x01\x03\x06Z\a\x03#4)\f \r\b\x01\x01\x01\x02\x02\t\x03\x06"},
-	{"runtime/race", "\xb0\x02"},
+	{"regexp", "\x03\xf2\x018\t\x02\x01\x02\x10\x02"},
+	{"regexp/syntax", "\xb6\x02\x01\x01\x01\x02\x10\x02"},
+	{"runtime", "\x97\x01\x04\x01\x03\f\x06\a\x02\x01\x01\x0e\x03\x01\x01\x01\x02\x01\x01\x02\x01\x04\x01\x10c"},
+	{"runtime/coverage", "\xa3\x01R"},
+	{"runtime/debug", "tTY\r\b\x02\x01\x10\x06"},
+	{"runtime/metrics", "\xba\x01G-!"},
+	{"runtime/pprof", "\x02\x01\x01\x03\x06]\a\x03#$\x0f+\f \r\b\x01\x01\x01\x02\x02\t\x03\x06"},
+	{"runtime/race", "\xb4\x02"},
 	{"runtime/race/internal/amd64v1", ""},
-	{"runtime/trace", "\ra\x03w\t9\b\x05\x01\r\x06"},
-	{"slices", "\x04\xf0\x01\fK"},
-	{"sort", "\xca\x0162"},
-	{"strconv", "n*@%\x03I"},
-	{"strings", "n&\x04@\x19\x03\f7\x10\x02\x02"},
+	{"runtime/trace", "\rd\x03x\t9\b\x05\x01\r\x06"},
+	{"slices", "\x04\xf4\x01\fK"},
+	{"sort", "\xcc\x0182"},
+	{"strconv", "q*@\x01q"},
+	{"strings", "q&\x04A\x19\x03\f7\x10\x02\x02"},
 	{"structs", ""},
-	{"sync", "\xc9\x01\x10\x01P\x0e\x13"},
-	{"sync/atomic", "\xcb\x02"},
-	{"syscall", "n'\x03\x01\x1c\b\x03\x03\x06\vV\b\x05\x01\x13"},
-	{"testing", "\x03\na\x02\x01X\x14\x14\f\x05\x1b\x06\x02\x05\x02\x05\x01\x02\x01\x02\x01\r\x02\x02\x02"},
-	{"testing/fstest", "n\x03\x80\x01\x01\n&\x10\x03\b\b"},
-	{"testing/internal/testdeps", "\x02\v\xa7\x01-\x10,\x03\x05\x03\x06\a\x02\x0e"},
-	{"testing/iotest", "\x03k\x03\x80\x01\x04"},
-	{"testing/quick", "p\x01\x8c\x01\x05#\x10\x10"},
-	{"testing/slogtest", "\ra\x03\x86\x01.\x05\x10\v"},
-	{"testing/synctest", "\xda\x01`\x11"},
-	{"text/scanner", "\x03n\x80\x01,*\x02"},
-	{"text/tabwriter", "q\x80\x01X"},
-	{"text/template", "n\x03B>\x01\n \x01\x05\x01\x02\x05\v\x02\r\x03\x02"},
-	{"text/template/parse", "\x03n\xb9\x01\n\x01\x12\x02"},
-	{"time", "n*\x1e\"(*\r\x02\x12"},
-	{"time/tzdata", "n\xcb\x01\x12"},
+	{"sync", "\xcb\x01\x12\x01P\x0e\x13"},
+	{"sync/atomic", "\xcf\x02"},
+	{"syscall", "q'\x03\x01\x1c\n\x03\x06\f\x04S\b\x05\x01\x13"},
+	{"testing", "\x03\nd\x02\x01W\x16\x14\f\x05\x1b\x06\x02\x05\x02\x05\x01\x02\x01\x02\x01\r\x02\x04"},
+	{"testing/fstest", "q\x03\x81\x01\x01\n&\x10\x03\b\b"},
+	{"testing/internal/testdeps", "\x02\v\xaa\x01.\x10,\x03\x05\x03\x06\a\x02\x0e"},
+	{"testing/iotest", "\x03n\x03\x81\x01\x04"},
+	{"testing/quick", "s\x01\x8d\x01\x05#\x10\x10"},
+	{"testing/slogtest", "\rd\x03\x87\x01.\x05\x10\v"},
+	{"testing/synctest", "\xde\x01`\x11"},
+	{"text/scanner", "\x03q\x81\x01,*\x02"},
+	{"text/tabwriter", "t\x81\x01X"},
+	{"text/template", "q\x03B?\x01\n \x01\x05\x01\x02\x05\v\x02\r\x03\x02"},
+	{"text/template/parse", "\x03q\xba\x01\n\x01\x12\x02"},
+	{"time", "q*\x1e#(*\r\x02\x12"},
+	{"time/tzdata", "q\xcc\x01\x12"},
 	{"unicode", ""},
 	{"unicode/utf16", ""},
 	{"unicode/utf8", ""},
-	{"unique", "\x94\x01!#\x01Q\r\x01\x13\x12"},
+	{"unique", "\x97\x01!$\x01Q\r\x01\x13\x12"},
 	{"unsafe", ""},
-	{"vendor/golang.org/x/crypto/chacha20", "\x10W\a\x92\x01*&"},
-	{"vendor/golang.org/x/crypto/chacha20poly1305", "\x10W\a\xde\x01\x04\x01\a"},
-	{"vendor/golang.org/x/crypto/cryptobyte", "d\n\x03\x8d\x01' \n"},
+	{"vendor/golang.org/x/crypto/chacha20", "\x10Z\a\x93\x01*&"},
+	{"vendor/golang.org/x/crypto/chacha20poly1305", "\x10Z\a\xdf\x01\x04\x01\a"},
+	{"vendor/golang.org/x/crypto/cryptobyte", "g\n\x03\x8e\x01' \n"},
 	{"vendor/golang.org/x/crypto/cryptobyte/asn1", ""},
-	{"vendor/golang.org/x/crypto/internal/alias", "\xcb\x02"},
-	{"vendor/golang.org/x/crypto/internal/poly1305", "R\x15\x99\x01"},
-	{"vendor/golang.org/x/net/dns/dnsmessage", "n"},
-	{"vendor/golang.org/x/net/http/httpguts", "\x87\x02\x14\x1a\x14\r"},
-	{"vendor/golang.org/x/net/http/httpproxy", "n\x03\x96\x01\x10\x05\x01\x18\x14\r"},
-	{"vendor/golang.org/x/net/http2/hpack", "\x03k\x03\x80\x01F"},
-	{"vendor/golang.org/x/net/idna", "q\x8c\x018\x14\x10\x02\x01"},
-	{"vendor/golang.org/x/net/nettest", "\x03d\a\x03\x80\x01\x11\x05\x16\x01\f\n\x01\x02\x02\x01\v"},
-	{"vendor/golang.org/x/sys/cpu", "\x9d\x02\r\n\x01\x16"},
-	{"vendor/golang.org/x/text/secure/bidirule", "n\xdb\x01\x11\x01"},
-	{"vendor/golang.org/x/text/transform", "\x03k\x83\x01X"},
-	{"vendor/golang.org/x/text/unicode/bidi", "\x03\bf\x84\x01>\x16"},
-	{"vendor/golang.org/x/text/unicode/norm", "g\n\x80\x01F\x12\x11"},
-	{"weak", "\x94\x01\x96\x01!"},
+	{"vendor/golang.org/x/crypto/internal/alias", "\xcf\x02"},
+	{"vendor/golang.org/x/crypto/internal/poly1305", "U\x15\x9a\x01"},
+	{"vendor/golang.org/x/net/dns/dnsmessage", "q"},
+	{"vendor/golang.org/x/net/http/httpguts", "\x8b\x02\x14\x1a\x14\r"},
+	{"vendor/golang.org/x/net/http/httpproxy", "q\x03\x97\x01\x10\x05\x01\x18\x14\r"},
+	{"vendor/golang.org/x/net/http2/hpack", "\x03n\x03\x81\x01F"},
+	{"vendor/golang.org/x/net/idna", "t\x8d\x018\x14\x10\x02\x01"},
+	{"vendor/golang.org/x/net/nettest", "\x03g\a\x03\x81\x01\x11\x05\x16\x01\f\n\x01\x02\x02\x01\v"},
+	{"vendor/golang.org/x/sys/cpu", "\xa1\x02\r\n\x01\x16"},
+	{"vendor/golang.org/x/text/secure/bidirule", "q\xdc\x01\x11\x01"},
+	{"vendor/golang.org/x/text/transform", "\x03n\x84\x01X"},
+	{"vendor/golang.org/x/text/unicode/bidi", "\x03\bi\x85\x01>\x16"},
+	{"vendor/golang.org/x/text/unicode/norm", "j\n\x81\x01F\x12\x11"},
+	{"weak", "\x97\x01\x97\x01!"},
 }
+
+// bootstrap is the list of bootstrap packages extracted from cmd/dist.
+var bootstrap = map[string]bool{
+	"cmp":                                     true,
+	"cmd/asm":                                 true,
+	"cmd/asm/internal/arch":                   true,
+	"cmd/asm/internal/asm":                    true,
+	"cmd/asm/internal/flags":                  true,
+	"cmd/asm/internal/lex":                    true,
+	"cmd/cgo":                                 true,
+	"cmd/compile":                             true,
+	"cmd/compile/internal/abi":                true,
+	"cmd/compile/internal/abt":                true,
+	"cmd/compile/internal/amd64":              true,
+	"cmd/compile/internal/arm":                true,
+	"cmd/compile/internal/arm64":              true,
+	"cmd/compile/internal/base":               true,
+	"cmd/compile/internal/bitvec":             true,
+	"cmd/compile/internal/compare":            true,
+	"cmd/compile/internal/coverage":           true,
+	"cmd/compile/internal/deadlocals":         true,
+	"cmd/compile/internal/devirtualize":       true,
+	"cmd/compile/internal/dwarfgen":           true,
+	"cmd/compile/internal/escape":             true,
+	"cmd/compile/internal/gc":                 true,
+	"cmd/compile/internal/importer":           true,
+	"cmd/compile/internal/inline":             true,
+	"cmd/compile/internal/inline/inlheur":     true,
+	"cmd/compile/internal/inline/interleaved": true,
+	"cmd/compile/internal/ir":                 true,
+	"cmd/compile/internal/liveness":           true,
+	"cmd/compile/internal/logopt":             true,
+	"cmd/compile/internal/loong64":            true,
+	"cmd/compile/internal/loopvar":            true,
+	"cmd/compile/internal/mips":               true,
+	"cmd/compile/internal/mips64":             true,
+	"cmd/compile/internal/noder":              true,
+	"cmd/compile/internal/objw":               true,
+	"cmd/compile/internal/pgoir":              true,
+	"cmd/compile/internal/pkginit":            true,
+	"cmd/compile/internal/ppc64":              true,
+	"cmd/compile/internal/rangefunc":          true,
+	"cmd/compile/internal/reflectdata":        true,
+	"cmd/compile/internal/riscv64":            true,
+	"cmd/compile/internal/rttype":             true,
+	"cmd/compile/internal/s390x":              true,
+	"cmd/compile/internal/ssa":                true,
+	"cmd/compile/internal/ssagen":             true,
+	"cmd/compile/internal/staticdata":         true,
+	"cmd/compile/internal/staticinit":         true,
+	"cmd/compile/internal/syntax":             true,
+	"cmd/compile/internal/test":               true,
+	"cmd/compile/internal/typebits":           true,
+	"cmd/compile/internal/typecheck":          true,
+	"cmd/compile/internal/types":              true,
+	"cmd/compile/internal/types2":             true,
+	"cmd/compile/internal/walk":               true,
+	"cmd/compile/internal/wasm":               true,
+	"cmd/compile/internal/x86":                true,
+	"cmd/internal/archive":                    true,
+	"cmd/internal/bio":                        true,
+	"cmd/internal/codesign":                   true,
+	"cmd/internal/dwarf":                      true,
+	"cmd/internal/edit":                       true,
+	"cmd/internal/gcprog":                     true,
+	"cmd/internal/goobj":                      true,
+	"cmd/internal/hash":                       true,
+	"cmd/internal/macho":                      true,
+	"cmd/internal/obj":                        true,
+	"cmd/internal/obj/arm":                    true,
+	"cmd/internal/obj/arm64":                  true,
+	"cmd/internal/obj/loong64":                true,
+	"cmd/internal/obj/mips":                   true,
+	"cmd/internal/obj/ppc64":                  true,
+	"cmd/internal/obj/riscv":                  true,
+	"cmd/internal/obj/s390x":                  true,
+	"cmd/internal/obj/wasm":                   true,
+	"cmd/internal/obj/x86":                    true,
+	"cmd/internal/objabi":                     true,
+	"cmd/internal/par":                        true,
+	"cmd/internal/pgo":                        true,
+	"cmd/internal/pkgpath":                    true,
+	"cmd/internal/quoted":                     true,
+	"cmd/internal/src":                        true,
+	"cmd/internal/sys":                        true,
+	"cmd/internal/telemetry":                  true,
+	"cmd/internal/telemetry/counter":          true,
+	"cmd/link":                                true,
+	"cmd/link/internal/amd64":                 true,
+	"cmd/link/internal/arm":                   true,
+	"cmd/link/internal/arm64":                 true,
+	"cmd/link/internal/benchmark":             true,
+	"cmd/link/internal/dwtest":                true,
+	"cmd/link/internal/ld":                    true,
+	"cmd/link/internal/loadelf":               true,
+	"cmd/link/internal/loader":                true,
+	"cmd/link/internal/loadmacho":             true,
+	"cmd/link/internal/loadpe":                true,
+	"cmd/link/internal/loadxcoff":             true,
+	"cmd/link/internal/loong64":               true,
+	"cmd/link/internal/mips":                  true,
+	"cmd/link/internal/mips64":                true,
+	"cmd/link/internal/ppc64":                 true,
+	"cmd/link/internal/riscv64":               true,
+	"cmd/link/internal/s390x":                 true,
+	"cmd/link/internal/sym":                   true,
+	"cmd/link/internal/wasm":                  true,
+	"cmd/link/internal/x86":                   true,
+	"compress/flate":                          true,
+	"compress/zlib":                           true,
+	"container/heap":                          true,
+	"debug/dwarf":                             true,
+	"debug/elf":                               true,
+	"debug/macho":                             true,
+	"debug/pe":                                true,
+	"go/build/constraint":                     true,
+	"go/constant":                             true,
+	"go/version":                              true,
+	"internal/abi":                            true,
+	"internal/coverage":                       true,
+	"cmd/internal/cov/covcmd":                 true,
+	"internal/bisect":                         true,
+	"internal/buildcfg":                       true,
+	"internal/exportdata":                     true,
+	"internal/goarch":                         true,
+	"internal/godebugs":                       true,
+	"internal/goexperiment":                   true,
+	"internal/goroot":                         true,
+	"internal/gover":                          true,
+	"internal/goversion":                      true,
+	"internal/lazyregexp":                     true,
+	"internal/pkgbits":                        true,
+	"internal/platform":                       true,
+	"internal/profile":                        true,
+	"internal/race":                           true,
+	"internal/runtime/gc":                     true,
+	"internal/saferio":                        true,
+	"internal/syscall/unix":                   true,
+	"internal/types/errors":                   true,
+	"internal/unsafeheader":                   true,
+	"internal/xcoff":                          true,
+	"internal/zstd":                           true,
+	"math/bits":                               true,
+	"sort":                                    true,
+}
+
+// BootstrapVersion is the minor version of Go used during toolchain
+// bootstrapping. Packages for which [IsBootstrapPackage] must not use
+// features of Go newer than this version.
+const BootstrapVersion = Version(24) // go1.24.6
@@ -87,3 +87,11 @@ func find(pkg string) (int, bool) {
 		return strings.Compare(p.name, n)
 	})
 }
+
+// IsBootstrapPackage reports whether pkg is one of the low-level
+// packages in the Go distribution that must compile with the older
+// language version specified by [BootstrapVersion] during toolchain
+// bootstrapping; see golang.org/s/go15bootstrap.
+func IsBootstrapPackage(pkg string) bool {
+	return bootstrap[pkg]
+}
@@ -225,6 +225,7 @@ var PackageSymbols = map[string][]Symbol{
 		{"(*Buffer).Grow", Method, 1, ""},
 		{"(*Buffer).Len", Method, 0, ""},
 		{"(*Buffer).Next", Method, 0, ""},
+		{"(*Buffer).Peek", Method, 26, ""},
 		{"(*Buffer).Read", Method, 0, ""},
 		{"(*Buffer).ReadByte", Method, 0, ""},
 		{"(*Buffer).ReadBytes", Method, 0, ""},
@@ -1628,6 +1629,7 @@ var PackageSymbols = map[string][]Symbol{
 		{"ResultNoRows", Var, 0, ""},
 		{"Rows", Type, 0, ""},
 		{"RowsAffected", Type, 0, ""},
+		{"RowsColumnScanner", Type, 26, ""},
 		{"RowsColumnTypeDatabaseTypeName", Type, 8, ""},
 		{"RowsColumnTypeLength", Type, 8, ""},
 		{"RowsColumnTypeNullable", Type, 8, ""},
@@ -4953,6 +4955,7 @@ var PackageSymbols = map[string][]Symbol{
 	},
 	"errors": {
 		{"As", Func, 13, "func(err error, target any) bool"},
+		{"AsType", Func, 26, "func[E error](err error) (E, bool)"},
 		{"ErrUnsupported", Var, 21, ""},
 		{"Is", Func, 13, "func(err error, target error) bool"},
 		{"Join", Func, 20, "func(errs ...error) error"},
@@ -5090,7 +5093,7 @@ var PackageSymbols = map[string][]Symbol{
 		{"Append", Func, 19, "func(b []byte, a ...any) []byte"},
 		{"Appendf", Func, 19, "func(b []byte, format string, a ...any) []byte"},
 		{"Appendln", Func, 19, "func(b []byte, a ...any) []byte"},
-		{"Errorf", Func, 0, "func(format string, a ...any) error"},
+		{"Errorf", Func, 0, "func(format string, a ...any) (err error)"},
 		{"FormatString", Func, 20, "func(state State, verb rune) string"},
 		{"Formatter", Type, 0, ""},
 		{"Fprint", Func, 0, "func(w io.Writer, a ...any) (n int, err error)"},
@@ -5155,6 +5158,9 @@ var PackageSymbols = map[string][]Symbol{
 		{"(*DeclStmt).Pos", Method, 0, ""},
 		{"(*DeferStmt).End", Method, 0, ""},
 		{"(*DeferStmt).Pos", Method, 0, ""},
+		{"(*Directive).End", Method, 26, ""},
+		{"(*Directive).ParseArgs", Method, 26, ""},
+		{"(*Directive).Pos", Method, 26, ""},
 		{"(*Ellipsis).End", Method, 0, ""},
 		{"(*Ellipsis).Pos", Method, 0, ""},
 		{"(*EmptyStmt).End", Method, 0, ""},
@@ -5320,6 +5326,15 @@ var PackageSymbols = map[string][]Symbol{
 		{"DeferStmt", Type, 0, ""},
 		{"DeferStmt.Call", Field, 0, ""},
 		{"DeferStmt.Defer", Field, 0, ""},
+		{"Directive", Type, 26, ""},
+		{"Directive.Args", Field, 26, ""},
+		{"Directive.ArgsPos", Field, 26, ""},
+		{"Directive.Name", Field, 26, ""},
+		{"Directive.Slash", Field, 26, ""},
+		{"Directive.Tool", Field, 26, ""},
+		{"DirectiveArg", Type, 26, ""},
+		{"DirectiveArg.Arg", Field, 26, ""},
+		{"DirectiveArg.Pos", Field, 26, ""},
 		{"Ellipsis", Type, 0, ""},
 		{"Ellipsis.Ellipsis", Field, 0, ""},
 		{"Ellipsis.Elt", Field, 0, ""},
@@ -5469,6 +5484,7 @@ var PackageSymbols = map[string][]Symbol{
 		{"ParenExpr.Lparen", Field, 0, ""},
 		{"ParenExpr.Rparen", Field, 0, ""},
 		{"ParenExpr.X", Field, 0, ""},
+		{"ParseDirective", Func, 26, "func(pos token.Pos, c string) (Directive, bool)"},
 		{"Pkg", Const, 0, ""},
 		{"Preorder", Func, 23, "func(root Node) iter.Seq[Node]"},
 		{"PreorderStack", Func, 25, "func(root Node, stack []Node, f func(n Node, stack []Node) bool)"},
@@ -7271,6 +7287,10 @@ var PackageSymbols = map[string][]Symbol{
 		{"(*Logger).WarnContext", Method, 21, ""},
 		{"(*Logger).With", Method, 21, ""},
 		{"(*Logger).WithGroup", Method, 21, ""},
+		{"(*MultiHandler).Enabled", Method, 26, ""},
+		{"(*MultiHandler).Handle", Method, 26, ""},
+		{"(*MultiHandler).WithAttrs", Method, 26, ""},
+		{"(*MultiHandler).WithGroup", Method, 26, ""},
 		{"(*Record).Add", Method, 21, ""},
 		{"(*Record).AddAttrs", Method, 21, ""},
 		{"(*TextHandler).Enabled", Method, 21, ""},
@@ -7358,9 +7378,11 @@ var PackageSymbols = map[string][]Symbol{
 		{"LogValuer", Type, 21, ""},
 		{"Logger", Type, 21, ""},
 		{"MessageKey", Const, 21, ""},
+		{"MultiHandler", Type, 26, ""},
 		{"New", Func, 21, "func(h Handler) *Logger"},
 		{"NewJSONHandler", Func, 21, "func(w io.Writer, opts *HandlerOptions) *JSONHandler"},
 		{"NewLogLogger", Func, 21, "func(h Handler, level Level) *log.Logger"},
+		{"NewMultiHandler", Func, 26, "func(handlers ...Handler) *MultiHandler"},
 		{"NewRecord", Func, 21, "func(t time.Time, level Level, msg string, pc uintptr) Record"},
 		{"NewTextHandler", Func, 21, "func(w io.Writer, opts *HandlerOptions) *TextHandler"},
 		{"Record", Type, 21, ""},
@@ -7515,7 +7537,7 @@ var PackageSymbols = map[string][]Symbol{
 		{"MinInt64", Const, 0, ""},
 		{"MinInt8", Const, 0, ""},
 		{"Mod", Func, 0, "func(x float64, y float64) float64"},
-		{"Modf", Func, 0, "func(f float64) (int float64, frac float64)"},
+		{"Modf", Func, 0, "func(f float64) (integer float64, fractional float64)"},
 		{"NaN", Func, 0, "func() float64"},
 		{"Nextafter", Func, 0, "func(x float64, y float64) (r float64)"},
 		{"Nextafter32", Func, 4, "func(x float32, y float32) (r float32)"},
@@ -7972,6 +7994,10 @@ var PackageSymbols = map[string][]Symbol{
 		{"(*DNSError).Unwrap", Method, 23, ""},
 		{"(*Dialer).Dial", Method, 1, ""},
 		{"(*Dialer).DialContext", Method, 7, ""},
+		{"(*Dialer).DialIP", Method, 26, ""},
+		{"(*Dialer).DialTCP", Method, 26, ""},
+		{"(*Dialer).DialUDP", Method, 26, ""},
+		{"(*Dialer).DialUnix", Method, 26, ""},
 		{"(*Dialer).MultipathTCP", Method, 21, ""},
 		{"(*Dialer).SetMultipathTCP", Method, 21, ""},
 		{"(*IP).UnmarshalText", Method, 2, ""},
@@ -8457,6 +8483,7 @@ var PackageSymbols = map[string][]Symbol{
 		{"HTTP2Config.PermitProhibitedCipherSuites", Field, 24, ""},
 		{"HTTP2Config.PingTimeout", Field, 24, ""},
 		{"HTTP2Config.SendPingTimeout", Field, 24, ""},
+		{"HTTP2Config.StrictMaxConcurrentRequests", Field, 26, ""},
 		{"HTTP2Config.WriteByteTimeout", Field, 24, ""},
 		{"Handle", Func, 0, "func(pattern string, handler Handler)"},
 		{"HandleFunc", Func, 0, "func(pattern string, handler func(ResponseWriter, *Request))"},
@@ -8904,6 +8931,7 @@ var PackageSymbols = map[string][]Symbol{
 		{"(Prefix).AppendText", Method, 24, ""},
 		{"(Prefix).AppendTo", Method, 18, ""},
 		{"(Prefix).Bits", Method, 18, ""},
+		{"(Prefix).Compare", Method, 26, ""},
 		{"(Prefix).Contains", Method, 18, ""},
 		{"(Prefix).IsSingleIP", Method, 18, ""},
 		{"(Prefix).IsValid", Method, 18, ""},
@@ -9177,6 +9205,7 @@ var PackageSymbols = map[string][]Symbol{
 		{"(*Process).Release", Method, 0, ""},
 		{"(*Process).Signal", Method, 0, ""},
 		{"(*Process).Wait", Method, 0, ""},
+		{"(*Process).WithHandle", Method, 26, ""},
 		{"(*ProcessState).ExitCode", Method, 12, ""},
 		{"(*ProcessState).Exited", Method, 0, ""},
 		{"(*ProcessState).Pid", Method, 0, ""},
@@ -9234,6 +9263,7 @@ var PackageSymbols = map[string][]Symbol{
 		{"ErrExist", Var, 0, ""},
 		{"ErrInvalid", Var, 0, ""},
 		{"ErrNoDeadline", Var, 10, ""},
+		{"ErrNoHandle", Var, 26, ""},
 		{"ErrNotExist", Var, 0, ""},
 		{"ErrPermission", Var, 0, ""},
 		{"ErrProcessDone", Var, 16, ""},
@@ -9461,7 +9491,7 @@ var PackageSymbols = map[string][]Symbol{
 		{"ListSeparator", Const, 0, ""},
 		{"Localize", Func, 23, "func(path string) (string, error)"},
 		{"Match", Func, 0, "func(pattern string, name string) (matched bool, err error)"},
-		{"Rel", Func, 0, "func(basepath string, targpath string) (string, error)"},
+		{"Rel", Func, 0, "func(basePath string, targPath string) (string, error)"},
 		{"Separator", Const, 0, ""},
 		{"SkipAll", Var, 20, ""},
 		{"SkipDir", Var, 0, ""},
@@ -9932,7 +9962,7 @@ var PackageSymbols = map[string][]Symbol{
 		{"PanicNilError", Type, 21, ""},
 		{"Pinner", Type, 21, ""},
 		{"ReadMemStats", Func, 0, "func(m *MemStats)"},
-		{"ReadTrace", Func, 5, "func() []byte"},
+		{"ReadTrace", Func, 5, "func() (buf []byte)"},
 		{"SetBlockProfileRate", Func, 1, "func(rate int)"},
 		{"SetCPUProfileRate", Func, 0, "func(hz int)"},
 		{"SetCgoTraceback", Func, 7, "func(version int, traceback unsafe.Pointer, context unsafe.Pointer, symbolizer unsafe.Pointer)"},
@@ -16679,6 +16709,7 @@ var PackageSymbols = map[string][]Symbol{
 		{"ValueOf", Func, 0, ""},
 	},
 	"testing": {
+		{"(*B).ArtifactDir", Method, 26, ""},
 		{"(*B).Attr", Method, 25, ""},
 		{"(*B).Chdir", Method, 24, ""},
 		{"(*B).Cleanup", Method, 14, ""},
@@ -16713,6 +16744,7 @@ var PackageSymbols = map[string][]Symbol{
 		{"(*B).StopTimer", Method, 0, ""},
 		{"(*B).TempDir", Method, 15, ""},
 		{"(*F).Add", Method, 18, ""},
+		{"(*F).ArtifactDir", Method, 26, ""},
 		{"(*F).Attr", Method, 25, ""},
 		{"(*F).Chdir", Method, 24, ""},
 		{"(*F).Cleanup", Method, 18, ""},
@@ -16738,6 +16770,7 @@ var PackageSymbols = map[string][]Symbol{
 		{"(*F).TempDir", Method, 18, ""},
 		{"(*M).Run", Method, 4, ""},
 		{"(*PB).Next", Method, 3, ""},
+		{"(*T).ArtifactDir", Method, 26, ""},
 		{"(*T).Attr", Method, 25, ""},
 		{"(*T).Chdir", Method, 24, ""},
 		{"(*T).Cleanup", Method, 14, ""},
@@ -160,8 +160,7 @@ func computeTermSetInternal(t types.Type, seen map[types.Type]*termSet, depth in
 		// The term set of an interface is the intersection of the term sets of its
 		// embedded types.
 		tset.terms = allTermlist
-		for i := 0; i < u.NumEmbeddeds(); i++ {
-			embedded := u.EmbeddedType(i)
+		for embedded := range u.EmbeddedTypes() {
 			if _, ok := embedded.Underlying().(*types.TypeParam); ok {
 				return nil, fmt.Errorf("invalid embedded type %T", embedded)
 			}
@@ -174,8 +173,7 @@ func computeTermSetInternal(t types.Type, seen map[types.Type]*termSet, depth in
 	case *types.Union:
 		// The term set of a union is the union of term sets of its terms.
 		tset.terms = nil
-		for i := 0; i < u.Len(); i++ {
-			t := u.Term(i)
+		for t := range u.Terms() {
 			var terms termlist
 			switch t.Type().Underlying().(type) {
 			case *types.Interface:
@@ -35,8 +35,8 @@ func ForEachElement(rtypes *typeutil.Map, msets *typeutil.MethodSetCache, T type

 		// Recursion over signatures of each method.
 		tmset := msets.MethodSet(T)
-		for i := 0; i < tmset.Len(); i++ {
-			sig := tmset.At(i).Type().(*types.Signature)
+		for method := range tmset.Methods() {
+			sig := method.Type().(*types.Signature)
 			// It is tempting to call visit(sig, false)
 			// but, as noted in golang.org/cl/65450043,
 			// the Signature.Recv field is ignored by
@@ -19,25 +19,46 @@ func NoEffects(info *types.Info, expr ast.Expr) bool {
 		switch v := n.(type) {
 		case nil, *ast.Ident, *ast.BasicLit, *ast.BinaryExpr, *ast.ParenExpr,
 			*ast.SelectorExpr, *ast.IndexExpr, *ast.SliceExpr, *ast.TypeAssertExpr,
-			*ast.StarExpr, *ast.CompositeLit, *ast.ArrayType, *ast.StructType,
-			*ast.MapType, *ast.InterfaceType, *ast.KeyValueExpr:
-			// No effect
+			*ast.StarExpr, *ast.CompositeLit,
+			// non-expressions that may appear within expressions
+			*ast.KeyValueExpr,
+			*ast.FieldList,
+			*ast.Field,
+			*ast.Ellipsis,
+			*ast.IndexListExpr:
+			// No effect.
+
+		case *ast.ArrayType,
+			*ast.StructType,
+			*ast.ChanType,
+			*ast.FuncType,
+			*ast.MapType,
+			*ast.InterfaceType:
+			// Type syntax: no effects, recursively.
+			// Prune descent.
+			return false
+
 		case *ast.UnaryExpr:
-			// Channel send <-ch has effects
+			// Channel send <-ch has effects.
 			if v.Op == token.ARROW {
 				noEffects = false
 			}
-		case *ast.CallExpr:
-			// Type conversion has no effects
-			if !info.Types[v.Fun].IsType() {
-				// TODO(adonovan): Add a case for built-in functions without side
-				// effects (by using callsPureBuiltin from tools/internal/refactor/inline)

-				noEffects = false
+		case *ast.CallExpr:
+			// Type conversion has no effects.
+			if !info.Types[v.Fun].IsType() {
+				if CallsPureBuiltin(info, v) {
+					// A call such as len(e) has no effects of its
+					// own, though the subexpression e might.
+				} else {
+					noEffects = false
+				}
 			}
+
 		case *ast.FuncLit:
 			// A FuncLit has no effects, but do not descend into it.
 			return false
+
 		default:
 			// All other expressions have effects
 			noEffects = false
@@ -47,3 +68,21 @@ func NoEffects(info *types.Info, expr ast.Expr) bool {
 	})
 	return noEffects
 }
+
+// CallsPureBuiltin reports whether call is a call of a built-in
+// function that is a pure computation over its operands (analogous to
+// a + operator). Because it does not depend on program state, it may
+// be evaluated at any point--though not necessarily at multiple
+// points (consider new, make).
+func CallsPureBuiltin(info *types.Info, call *ast.CallExpr) bool {
+	if id, ok := ast.Unparen(call.Fun).(*ast.Ident); ok {
+		if b, ok := info.ObjectOf(id).(*types.Builtin); ok {
+			switch b.Name() {
+			case "len", "cap", "complex", "imag", "real", "make", "new", "max", "min":
+				return true
+			}
+			// Not: append clear close copy delete panic print println recover
+		}
+	}
+	return false
+}
@@ -48,7 +48,7 @@ func IsFunctionNamed(obj types.Object, pkgPath string, names ...string) bool {
 	return ok &&
 		IsPackageLevel(obj) &&
 		f.Pkg().Path() == pkgPath &&
-		f.Type().(*types.Signature).Recv() == nil &&
+		f.Signature().Recv() == nil &&
 		slices.Contains(names, f.Name())
 }

@@ -60,7 +60,7 @@ func IsFunctionNamed(obj types.Object, pkgPath string, names ...string) bool {
 // which is important for the performance of syntax matching.
 func IsMethodNamed(obj types.Object, pkgPath string, typeName string, names ...string) bool {
 	if fn, ok := obj.(*types.Func); ok {
-		if recv := fn.Type().(*types.Signature).Recv(); recv != nil {
+		if recv := fn.Signature().Recv(); recv != nil {
 			_, T := ReceiverNamed(recv)
 			return T != nil &&
 				IsTypeNamed(T, pkgPath, typeName) &&
@@ -19,7 +19,7 @@ import (
 // TODO(adonovan): this function ignores the effect of shadowing. It
 // should accept a [token.Pos] and a [types.Info] and compute only the
 // set of imports that are not shadowed at that point, analogous to
-// [analysisinternal.AddImport]. It could also compute (as a side
+// [analysis.AddImport]. It could also compute (as a side
 // effect) the set of additional imports required to ensure that there
 // is an accessible import for each necessary package, making it
 // converge even more closely with AddImport.
@@ -2,39 +2,22 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.

-package typesinternal
+//go:build go1.25

-// TODO(adonovan): when CL 645115 lands, define the go1.25 version of
-// this API that actually does something.
+package typesinternal

 import "go/types"

-type VarKind uint8
+type VarKind = types.VarKind

 const (
-	_          VarKind = iota // (not meaningful)
-	PackageVar                // a package-level variable
-	LocalVar                  // a local variable
-	RecvVar                   // a method receiver variable
-	ParamVar                  // a function parameter variable
-	ResultVar                 // a function result variable
-	FieldVar                  // a struct field
+	PackageVar = types.PackageVar
+	LocalVar   = types.LocalVar
+	RecvVar    = types.RecvVar
+	ParamVar   = types.ParamVar
+	ResultVar  = types.ResultVar
+	FieldVar   = types.FieldVar
 )

-func (kind VarKind) String() string {
-	return [...]string{
-		0:          "VarKind(0)",
-		PackageVar: "PackageVar",
-		LocalVar:   "LocalVar",
-		RecvVar:    "RecvVar",
-		ParamVar:   "ParamVar",
-		ResultVar:  "ResultVar",
-		FieldVar:   "FieldVar",
-	}[kind]
-}
-
-// GetVarKind returns an invalid VarKind.
-func GetVarKind(v *types.Var) VarKind { return 0 }
-
-// SetVarKind has no effect.
-func SetVarKind(v *types.Var, kind VarKind) {}
+func GetVarKind(v *types.Var) VarKind       { return v.Kind() }
+func SetVarKind(v *types.Var, kind VarKind) { v.SetKind(kind) }
@@ -0,0 +1,39 @@
+// Copyright 2024 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !go1.25
+
+package typesinternal
+
+import "go/types"
+
+type VarKind uint8
+
+const (
+	_          VarKind = iota // (not meaningful)
+	PackageVar                // a package-level variable
+	LocalVar                  // a local variable
+	RecvVar                   // a method receiver variable
+	ParamVar                  // a function parameter variable
+	ResultVar                 // a function result variable
+	FieldVar                  // a struct field
+)
+
+func (kind VarKind) String() string {
+	return [...]string{
+		0:          "VarKind(0)",
+		PackageVar: "PackageVar",
+		LocalVar:   "LocalVar",
+		RecvVar:    "RecvVar",
+		ParamVar:   "ParamVar",
+		ResultVar:  "ResultVar",
+		FieldVar:   "FieldVar",
+	}[kind]
+}
+
+// GetVarKind returns an invalid VarKind.
+func GetVarKind(v *types.Var) VarKind { return 0 }
+
+// SetVarKind has no effect.
+func SetVarKind(v *types.Var, kind VarKind) {}
@@ -258,12 +258,12 @@ func TypeExpr(t types.Type, qual types.Qualifier) ast.Expr {

 	case *types.Signature:
 		var params []*ast.Field
-		for i := 0; i < t.Params().Len(); i++ {
+		for v := range t.Params().Variables() {
 			params = append(params, &ast.Field{
-				Type: TypeExpr(t.Params().At(i).Type(), qual),
+				Type: TypeExpr(v.Type(), qual),
 				Names: []*ast.Ident{
 					{
-						Name: t.Params().At(i).Name(),
+						Name: v.Name(),
 					},
 				},
 			})
@@ -273,9 +273,9 @@ func TypeExpr(t types.Type, qual types.Qualifier) ast.Expr {
 			last.Type = &ast.Ellipsis{Elt: last.Type.(*ast.ArrayType).Elt}
 		}
 		var returns []*ast.Field
-		for i := 0; i < t.Results().Len(); i++ {
+		for v := range t.Results().Variables() {
 			returns = append(returns, &ast.Field{
-				Type: TypeExpr(t.Results().At(i).Type(), qual),
+				Type: TypeExpr(v.Type(), qual),
 			})
 		}
 		return &ast.FuncType{
@@ -315,8 +315,8 @@ func TypeExpr(t types.Type, qual types.Qualifier) ast.Expr {
 		if hasTypeArgs, ok := t.(interface{ TypeArgs() *types.TypeList }); ok {
 			if typeArgs := hasTypeArgs.TypeArgs(); typeArgs != nil && typeArgs.Len() > 0 {
 				var indices []ast.Expr
-				for i := range typeArgs.Len() {
-					indices = append(indices, TypeExpr(typeArgs.At(i), qual))
+				for t0 := range typeArgs.Types() {
+					indices = append(indices, TypeExpr(t0, qual))
 				}
 				expr = &ast.IndexListExpr{
 					X:       expr,
@@ -7,13 +7,17 @@ package versions
 // This file contains predicates for working with file versions to
 // decide when a tool should consider a language feature enabled.

-// GoVersions that features in x/tools can be gated to.
+// named constants, to avoid misspelling
 const (
 	Go1_18 = "go1.18"
 	Go1_19 = "go1.19"
 	Go1_20 = "go1.20"
 	Go1_21 = "go1.21"
 	Go1_22 = "go1.22"
+	Go1_23 = "go1.23"
+	Go1_24 = "go1.24"
+	Go1_25 = "go1.25"
+	Go1_26 = "go1.26"
 )

 // Future is an invalid unknown Go version sometime in the future.
@@ -817,6 +817,7 @@ func genExtensions(g *protogen.GeneratedFile, f *fileInfo) {
 			leadingComments = appendDeprecationSuffix(leadingComments,
 				x.Desc.ParentFile(),
 				x.Desc.Options().(*descriptorpb.FieldOptions).GetDeprecated())
+			g.AnnotateSymbol("E_"+x.GoIdent.GoName, protogen.Annotation{Location: x.Location})
 			g.P(leadingComments,
 				"E_", x.GoIdent, " = &", extensionTypesVarName(f), "[", allExtensionsByPtr[x], "]",
 				trailingComment(x.Comments.Trailing))
@@ -796,10 +796,12 @@ func opaqueGenWhichOneof(g *protogen.GeneratedFile, f *fileInfo, message *messag
 			caseType := opaqueOneofCaseTypeName(oneof)
 			g.P("const ", message.GoIdent.GoName, "_", oneof.GoName, "_not_set_case ", caseType, " = ", 0)
 			for _, f := range oneof.Fields {
+				g.AnnotateSymbol(message.GoIdent.GoName+"_"+f.GoName+"_case", protogen.Annotation{Location: f.Location})
 				g.P("const ", message.GoIdent.GoName, "_", f.GoName, "_case ", caseType, " = ", f.Desc.Number())
 			}
 			fieldtrackNoInterface(g, message.noInterface)
 			whicherName := oneof.MethodName("Which")
+			g.AnnotateSymbol(message.GoIdent.GoName+"."+whicherName, protogen.Annotation{Location: oneof.Location})
 			g.P("func (x *", message.GoIdent, ") ", whicherName, "() ", caseType, " {")
 			g.P("if x == nil {")
 			g.P("return ", message.GoIdent.GoName, "_", oneof.GoName, "_not_set_case ")
--- a/Show More
+++ b/Show More