vendor: align Go dependencies with Moby

Update shared modules to Moby's versions while keeping github.com/moby/go-archive at v0.2.0. Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2026-11-06 05:16:45 +00:00 · 2026-09-30 00:49:38 -07:00
1 parent 065bc5ed69
commit f79f3d20e1
@@ -1763,7 +1763,7 @@ func serve(ctx context.Context, grpcServer *grpc.Server, conn net.Conn) {
 		conn.Close()
 	}()
 	bklog.G(ctx).Debugf("serving grpc connection")
-	(&http2.Server{}).ServeConn(conn, &http2.ServeConnOpts{Handler: grpcServer})
+	(&http2.Server{}).ServeConn(conn, &http2.ServeConnOpts{Handler: grpcServer}) //nolint:staticcheck // This existing HTTP/2 connection is already established.
 }

 type markTypeFrontend struct{}
@@ -11,12 +11,12 @@ require (
 	github.com/ProtonMail/go-crypto v1.4.1
 	github.com/agext/levenshtein v1.2.3
 	github.com/armon/circbuf v0.0.0-20190214190532-5111143e8da2
-	github.com/aws/aws-sdk-go-v2 v1.43.8
-	github.com/aws/aws-sdk-go-v2/config v1.32.39
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.38
+	github.com/aws/aws-sdk-go-v2 v1.47.0
+	github.com/aws/aws-sdk-go-v2/config v1.33.4
+	github.com/aws/aws-sdk-go-v2/credentials v1.20.4
 	github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager v0.3.10
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.106.5
-	github.com/aws/smithy-go v1.27.10
+	github.com/aws/smithy-go v1.28.2
 	github.com/cespare/xxhash/v2 v2.3.0
 	github.com/containerd/accelerated-container-image v1.3.0
 	github.com/containerd/console v1.0.5
@@ -52,7 +52,7 @@ require (
 	github.com/moby/go-archive v0.2.0
 	github.com/moby/locker v1.0.1
 	github.com/moby/patternmatcher v0.6.1
-	github.com/moby/policy-helpers v0.0.0-20260901104222-dd6c5499c491
+	github.com/moby/policy-helpers v0.0.0-20260901142052-72f704e6cdb6
 	github.com/moby/profiles/seccomp v0.2.4
 	github.com/moby/sys/mountinfo v0.7.2
 	github.com/moby/sys/reexec v0.1.0
@@ -103,15 +103,15 @@ require (
 	go.opentelemetry.io/otel/sdk/metric v1.46.0
 	go.opentelemetry.io/otel/trace v1.46.0
 	go.opentelemetry.io/proto/otlp v1.11.0
-	golang.org/x/crypto v0.56.0
+	golang.org/x/crypto v0.57.0
 	golang.org/x/exp v0.0.0-20260603202125-055de637280b
 	golang.org/x/mod v0.41.0
-	golang.org/x/net v0.58.0
+	golang.org/x/net v0.59.0
 	golang.org/x/sync v0.23.0
 	golang.org/x/sys v0.48.0
 	golang.org/x/time v0.16.0
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5
-	google.golang.org/grpc v1.83.2
+	google.golang.org/grpc v1.84.0
 	google.golang.org/protobuf v1.36.12
 	kernel.org/pub/linux/libs/security/libcap/cap v1.2.78
 	tags.cncf.io/container-device-interface v1.1.1
@@ -123,19 +123,19 @@ require (
 	github.com/AzureAD/microsoft-authentication-library-for-go v1.7.0 // indirect
 	github.com/anchore/go-struct-converter v0.1.0 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.18 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.39 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.39 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.39 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.40 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.18 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.20 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.0 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.3 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.3 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.28 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.39 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.3 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.36 // indirect
-	github.com/aws/aws-sdk-go-v2/service/signin v1.5.8 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.33.8 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.8 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.45.8 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.10.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.38.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.50.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/blang/semver v3.5.1+incompatible // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
@@ -145,7 +145,7 @@ require (
 	github.com/containerd/fifo v1.1.0 // indirect
 	github.com/containerd/log/otel v0.1.0 // indirect
 	github.com/containerd/plugin v1.1.0 // indirect
-	github.com/containerd/ttrpc v1.2.9 // indirect
+	github.com/containerd/ttrpc v1.2.10 // indirect
 	github.com/containernetworking/cni v1.3.1 // indirect
 	github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 // indirect
 	github.com/cyphar/filepath-securejoin v0.7.0 // indirect
@@ -199,8 +199,8 @@ require (
 	github.com/oklog/ulid/v2 v2.1.1 // indirect
 	github.com/petermattis/goid v0.0.0-20240813172612-4fcff4a6cae7 // indirect
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
-	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.70.1 // indirect
+	github.com/prometheus/client_model v0.6.3 // indirect
+	github.com/prometheus/common v0.71.0 // indirect
 	github.com/prometheus/otlptranslator v1.0.0 // indirect
 	github.com/sasha-s/go-deadlock v0.3.5 // indirect
 	github.com/secure-systems-lab/go-securesystemslib v0.11.0 // indirect
@@ -217,8 +217,8 @@ require (
 	github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
-	golang.org/x/term v0.45.0 // indirect
-	golang.org/x/text v0.41.0 // indirect
+	golang.org/x/term v0.46.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260825221802-da73d73af1c5 // indirect
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2 // indirect
 	k8s.io/klog/v2 v2.140.0 // indirect
@@ -61,46 +61,46 @@ github.com/armon/circbuf v0.0.0-20190214190532-5111143e8da2 h1:7Ip0wMmLHLRJdrloD
 github.com/armon/circbuf v0.0.0-20190214190532-5111143e8da2/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
-github.com/aws/aws-sdk-go-v2 v1.43.8 h1:fpnrxwuwsoGIgjvgLeDU3y9w7YaHBxyF6AF3vQL8duw=
-github.com/aws/aws-sdk-go-v2 v1.43.8/go.mod h1:j7gYSq8dL95QejkFXxvQNESH4I9WGHFI6iO+vhqEi5Q=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.18 h1:LAfOuhAH331fmOjTQpAaOlH+Ftn7RzSDJ2VFwjdMMy4=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.18/go.mod h1:4e5xhuXHx1e4U9EthvbPP1r/DIMp5c2823OL8karzcM=
-github.com/aws/aws-sdk-go-v2/config v1.32.39 h1:3TYUWYWawsE9KF02G3dA7vsbwoCphyGOpFFEUugRs/4=
-github.com/aws/aws-sdk-go-v2/config v1.32.39/go.mod h1:/lPP/ciQurgJa6l6mbBX+b5MB1qaLrC9dd3YHtGvrhk=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.38 h1:Xf8j1+vzwPRCta9pFXjj0677BzXrRO2JbpAVNcdXnnI=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.38/go.mod h1:PGYzFTznwRAJ2q0m+oX+P8SlfZQKpBAKQCokNuMl3Sg=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.39 h1:9GLrXl8PKQ3+bMniXFg3vliMWJ+204bFcIvBCwJFglc=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.39/go.mod h1:MmlE5TLgq7+QbXKKUSzqUz4h0Uu5kz2SEe6iPX+ZFHI=
+github.com/aws/aws-sdk-go-v2 v1.47.0 h1:0jsHallhJCeaU0Ko48c/3FK1ctOQ7NpzggxriJOQ8MQ=
+github.com/aws/aws-sdk-go-v2 v1.47.0/go.mod h1:bttEH6JqnUL8LepvDVfdrds/fZ5bCIxzpe3abyUrhDU=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.20 h1:GPRlPwz40I2B2VrBEASOA3Bi77NyeqejNLkifosX0rs=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.20/go.mod h1:g7PNzKcsOKWb4fkSRBA7BZVAS6Y8IcxzN+nRohhQ1Q8=
+github.com/aws/aws-sdk-go-v2/config v1.33.4 h1:FzvkXKSzwqHni4U7nDigHg4jjtqMpVUuHgmZfSoJVQ0=
+github.com/aws/aws-sdk-go-v2/config v1.33.4/go.mod h1:VZqGZnZsCWVfK/iGPptJIyNIX3XEX6iQU2Rel4sLrr8=
+github.com/aws/aws-sdk-go-v2/credentials v1.20.4 h1:hTvrJJseKbvw32kmiE0G+u/9ZqpqscjDrTigHIXP2qs=
+github.com/aws/aws-sdk-go-v2/credentials v1.20.4/go.mod h1:gWp9O1ZBWwpcIrgV+mVHk4gZUurAEDkgypu/OXOlIaw=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.0 h1:AM4hHjww+PSFtt6E+UrBrPlZkWsePCLEt9AjkfQX+yM=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.0/go.mod h1:3x/yXezeQjpOvBb4jEMxrS8SXvpdvJ5abv6l5c1gWM8=
 github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager v0.3.10 h1:HTlKXO5sYRzuhg9HjcxoH1U5RQrNQVrUSMckJv8OMr4=
 github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager v0.3.10/go.mod h1:FfSlIcbXD1TwObBVUAJtPWV9YAu2moXHaK6pgDXuJW8=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.39 h1:YrEI22hVQcqMpq934ZoPQyJjGNzX4CGdrSDCjBD59sI=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.39/go.mod h1:N8qOX83LkaCeizvrfiNjwkBOXkxHt6a74CiZn8qz9F8=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.39 h1:Vo7UZzBjB6zS6feEOuBlpEgaj8iBTdiNlye+7w9ooGo=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.39/go.mod h1:JgxtAO/77e95Rs9WMWUzz99hT182gqdAh7/DHuEMA/k=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.40 h1:oofDq8Y5M82fmDrxb8gsbP0LS73MqZ388qKVgs5ETYI=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.40/go.mod h1:LSfLmbvx50+T+/DoUZRqB1qS38v7lvNUebqIpidAWYM=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.18 h1:+fiwOxNdE8bOK3SoVTln8hwP+OCyArbi2/InIr/A9AU=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.18/go.mod h1:aua4m7EZSvQra/96b8zJxWHwtHxuXQ8bx4DiM92V044=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.3 h1:Hp/VgjP0BysR3OgLlR057Vz2LcbbVnoWeJ+3qWiS/fY=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.3/go.mod h1:nwGV5qw7F1IZPgxCvA/ph8N2TAuz+BkRG/bXn808qMA=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.3 h1:MUaM4f+kj1ZIBPZfUS8cxP1GKXXZtHJjAthy93AN7SM=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.3/go.mod h1:6YmVmEVRI5ZZzRjCSsb9SryKH0hAlMRdgA7kG9aDvBU=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.3 h1:fuSCw4Z2qfRCztMPO3GXJNSiEp6Wee+WOLwrHHUMy9c=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.3/go.mod h1:6SxcHheD1pPR5+kWm1wGvjlL/YqUsh267sAfEmN4K7A=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19 h1:bAdDl/HkGCcGPoe25ToSHEw23VIxt6CT5fLcg111BKg=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19/go.mod h1:KaUzbLxv4CeSxh6ZCl9B4m7CuFenS8kUEaDs+f/DQr4=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.28 h1:Q1TF1J9jVD+vFo0LzNnmNdQ9EAt52TS+MQlq9Ir+Yxo=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.28/go.mod h1:4KqXXC/p1hrotmouDFbrRoWaLy962b9PMUReCG6+uWo=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.39 h1:inoUrqz4Lfpw1XwpUvQnBiAJ2tUzn3opZ0gduNLxo+8=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.39/go.mod h1:Yx+RrmAF+XGZTccwhQ3o4K5V8qkZBsTAcq148Y8g57k=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.3 h1:bON1rJf67TSTDCKg816AAIE4xSTtoo9tl0XRkO72R+I=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.3/go.mod h1:c5BBpjJcQXpfeq9iASyVKA3T6vX6B6LEXY4mL/gklDY=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.36 h1:EUIwBoN+q7UmhAejxgD27APiRjh1vwCFo53gSqdT0BM=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.36/go.mod h1:6u00gmlTGR6W0b2k9NBrld7MnOEmf1Spqx0VVt6AqyE=
 github.com/aws/aws-sdk-go-v2/service/kms v1.52.0 h1:QNtg+Mtj1zmepk568+UKBD5DFfqh+ESTUUqQT27JkQc=
 github.com/aws/aws-sdk-go-v2/service/kms v1.52.0/go.mod h1:Y0+uxvxz6ib4KktRdK0V4X45Vcs/JyYoz8H71pO8xeI=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.106.5 h1:HpN6GgZ3T8pSvRp81ZsgumNjlvRsa+9M0ZL2o6W4uLY=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.106.5/go.mod h1:5FTZoQxhmLEiCAtYVk6V+t0iS/B5yGZVLZ3Wq5FDJZI=
-github.com/aws/aws-sdk-go-v2/service/signin v1.5.8 h1:bghrxelVQpGurGI1X94BT68h6p+hWQnlsu8nSmiSll4=
-github.com/aws/aws-sdk-go-v2/service/signin v1.5.8/go.mod h1:gkwdIl9w+6LFKlGRLz3+Dw+cudc9dD1ViMDhHGmzOgk=
-github.com/aws/aws-sdk-go-v2/service/sso v1.33.8 h1:/DbiPZ8maO03uFnXa6yEhFdWOTA5xObmGNfaEzt9Cac=
-github.com/aws/aws-sdk-go-v2/service/sso v1.33.8/go.mod h1:mUywXl2WlN+gZD0vNeg1Hn0EMOifDQ79StJcdqXHkXo=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.8 h1:wv4pCyq/LkBYc5R4m/g5S+uGqF/DbL+bp9VXiQEnec4=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.8/go.mod h1:9AKVT0vADSCPXRuoZjziHwsbdLDFMGRExwWBQourCa8=
-github.com/aws/aws-sdk-go-v2/service/sts v1.45.8 h1:oQrmuqpBAExYPEPJp8dkj9KLmc0y42iwvAV28OwlzF0=
-github.com/aws/aws-sdk-go-v2/service/sts v1.45.8/go.mod h1:qNTXKrmzx2cC6VmM7PxHNasBMWKx3mfxgzcbVjcWVAU=
-github.com/aws/smithy-go v1.27.10 h1:bw56MIx8bhTQZSdzucEJSKWLpwX0ju7hU8cVoa75dg8=
-github.com/aws/smithy-go v1.27.10/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/aws/aws-sdk-go-v2/service/signin v1.10.0 h1:ZD5qFpWcaOKdTuhBi431pIDkCgrMkMlMT6jlpSPoIRI=
+github.com/aws/aws-sdk-go-v2/service/signin v1.10.0/go.mod h1:8Nuuf+tR346PjJ3MvZPh9pekbLiLQFWJhzMXfwy7alA=
+github.com/aws/aws-sdk-go-v2/service/sso v1.38.0 h1:JGeeBcMlhg1xtOXYpeCaTQBZObtXMPQCUqBcmr65NRA=
+github.com/aws/aws-sdk-go-v2/service/sso v1.38.0/go.mod h1:XwteswG9EOMRFm73UT0t+MbTwyLxMrEXkU6e+v92Lzo=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.0 h1:obhahQXDEdVEv8y5bTKXR30LVaxYe1kyYM0L7l2Iq+k=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.0/go.mod h1:6twZZ/aXHNy1vXUO8koUbp++MYzMASkOgEBdkbJYmO0=
+github.com/aws/aws-sdk-go-v2/service/sts v1.50.0 h1:khXV3+K5D3f4e8xtplaRdSFn1bEg3gj5EBHQvbCOZbQ=
+github.com/aws/aws-sdk-go-v2/service/sts v1.50.0/go.mod h1:/8JRcdTt//hG0Q4BTmGbuOplT7ABe+5rdtqUHqXvYIM=
+github.com/aws/smithy-go v1.28.2 h1:myhcykQcatTul2B/zITjDk203G7t0awUAs1hVry5Bvg=
+github.com/aws/smithy-go v1.28.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ=
@@ -156,8 +156,8 @@ github.com/containerd/stargz-snapshotter v0.18.2 h1:Ev/sxfQUjwzJQ9eqy3XzttcQ3osM
 github.com/containerd/stargz-snapshotter v0.18.2/go.mod h1:iS0a4lgCFjGbdBJNrm1jwvaMFGGnQ6PZ5Sd09i060h8=
 github.com/containerd/stargz-snapshotter/estargz v0.18.2 h1:yXkZFYIzz3eoLwlTUZKz2iQ4MrckBxJjkmD16ynUTrw=
 github.com/containerd/stargz-snapshotter/estargz v0.18.2/go.mod h1:XyVU5tcJ3PRpkA9XS2T5us6Eg35yM0214Y+wvrZTBrY=
-github.com/containerd/ttrpc v1.2.9 h1:ha0ak962T0s3CA/RoZ6S6xiWZQF24GrBaEpiGX1uihg=
-github.com/containerd/ttrpc v1.2.9/go.mod h1:jjtQRwXm4DL3KsHKW8vDiUOV6wO0hi6IPhmJhxU7aEs=
+github.com/containerd/ttrpc v1.2.10 h1:qQvy3mokhoXON7FXiOOc05O7Up6nrNj6amJF8urNvDc=
+github.com/containerd/ttrpc v1.2.10/go.mod h1:YrmEQKkMbBA4EM26AzVAIwHGIYgptkL4CJ/yVTaDyBE=
 github.com/containerd/typeurl/v2 v2.3.0 h1:HZHPhRWo5XMy3QGQoPrUzbW/2ckwjfweHmOwlkIrPAQ=
 github.com/containerd/typeurl/v2 v2.3.0/go.mod h1:Qk+PAdUYArVj41TnGi6rJ+48RF0PkcTc4i/taoBcK0w=
 github.com/containernetworking/cni v1.3.1 h1:gnHlU/YC1bJcS+CSh+pYQKeuu4O4gsMGW1NMaLhkzW4=
@@ -374,8 +374,8 @@ github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
 github.com/moby/patternmatcher v0.6.1 h1:qlhtafmr6kgMIJjKJMDmMWq7WLkKIo23hsrpR3x084U=
 github.com/moby/patternmatcher v0.6.1/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
-github.com/moby/policy-helpers v0.0.0-20260901104222-dd6c5499c491 h1:5qXAyBr9AXXAqPoFK/wY85wggaKyYSMCNh8QF/O21Rk=
-github.com/moby/policy-helpers v0.0.0-20260901104222-dd6c5499c491/go.mod h1:77BSYHqLljY8i6FWZhQ2V7xmgNP3eftoIRV5yHYspDs=
+github.com/moby/policy-helpers v0.0.0-20260901142052-72f704e6cdb6 h1:wxmKL9KLJGSNWvWZwkEmhN5RhGpmz+Jzp4Yu4scoM0I=
+github.com/moby/policy-helpers v0.0.0-20260901142052-72f704e6cdb6/go.mod h1:hNMdiq4WjSmuyvy8lWcflH6erzSg/MgZlFyM7vC7Z2c=
 github.com/moby/profiles/seccomp v0.2.4 h1:CNKIR4jNYCGIdstSZ3plN/yF3WCqlupmNLwO1ckLwz4=
 github.com/moby/profiles/seccomp v0.2.4/go.mod h1:H3JkVP4MWq+Q87sSWRUEdiZvK52WErUbcxr+mJHKVoM=
 github.com/moby/sys/mount v0.3.5 h1:eS3fsZTjHaBihwjp4/+5Z3jxqLXYsbwxqpVSfFv3M00=
@@ -430,10 +430,10 @@ github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU=
 github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE=
-github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
-github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.70.1 h1:1HvjP4D5oL3t8RsPlwxA9onvvStjtIHYE5XuuwOi/PY=
-github.com/prometheus/common v0.70.1/go.mod h1:VdFUQDMZK3VLkurFUVhia6uys/0suUp86TJz5qbJRhc=
+github.com/prometheus/client_model v0.6.3 h1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=
+github.com/prometheus/client_model v0.6.3/go.mod h1:gpN5P9S7Rr6Yr92PiQ+Ixvhf6JZEkF1dnxsYL2aPBEM=
+github.com/prometheus/common v0.71.0 h1:9KDAKb7Mj3HEVKyFCK6Dc/HIwlBzZIN2l7/lrHl3KK8=
+github.com/prometheus/common v0.71.0/go.mod h1:CLJ5H8TEsGX8bl31BdMkfhIZ+QmZ9tBPPotUxUbfcmk=
 github.com/prometheus/otlptranslator v1.0.0 h1:s0LJW/iN9dkIH+EnhiD3BlkkP5QVIUVEoIwkU+A6qos=
 github.com/prometheus/otlptranslator v1.0.0/go.mod h1:vRYWnXvI6aWGpsdY/mOT/cbeVRBlPWtBNDb7kGR3uKM=
 github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=
@@ -587,14 +587,14 @@ go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
-golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
-golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
 golang.org/x/exp v0.0.0-20260603202125-055de637280b h1:v1uXiEBHo8QA0LiGCo7UgHMzHT4Kdfpl2zmtH5vaP1Q=
 golang.org/x/exp v0.0.0-20260603202125-055de637280b/go.mod h1:d2fgXJLVs4dYDHUk5lwMIfzRzSrWCfGZb0ZqeLa/Vcw=
 golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
 golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
-golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
-golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
+golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
+golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
@@ -605,10 +605,10 @@ golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
 golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
+golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 golang.org/x/time v0.16.0 h1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q/6gY2hDM6VDE=
 golang.org/x/time v0.16.0/go.mod h1:rVKOqvZeKvrDKTQiAHJ7wmwP0RzleSphoEA9RcdLA0s=
 golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
@@ -623,8 +623,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260825221802-da73d73af1c5 h1:
 google.golang.org/genproto/googleapis/api v0.0.0-20260825221802-da73d73af1c5/go.mod h1:3LhxRw4YYkf+ylAfgaY9JlVLFKhokkCV8duhLLe7+t0=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5 h1:1VUiZAXyC+zmiFYi+WLtBzr68Cj8wOofHjjrA/kkizc=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA=
-google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
-google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
+google.golang.org/grpc v1.84.0 h1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0=
+google.golang.org/grpc v1.84.0/go.mod h1:ljCht0DrxQrXBDRTZp52Qxh3Ffk8CdYm2sj4O2QN2C0=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2 h1:rgSNvqscFZ1JgV/4wH5GOsZFSFkR2Eua9As3KIr2LlM=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.2/go.mod h1:iMEtFwDlAhjDU9L5mY6U1XLwlIId/G3h+QcBHDIvrJ8=
 google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
@@ -63,7 +63,7 @@ func serve(ctx context.Context, grpcServer *grpc.Server, conn net.Conn) {
 		conn.Close()
 	}()
 	bklog.G(ctx).Debugf("serving grpc connection")
-	(&http2.Server{}).ServeConn(conn, &http2.ServeConnOpts{Handler: grpcServer})
+	(&http2.Server{}).ServeConn(conn, &http2.ServeConnOpts{Handler: grpcServer}) //nolint:staticcheck // This existing HTTP/2 connection is already established.
 }

 func grpcClientConn(ctx context.Context, conn net.Conn, opts map[string][]string) (context.Context, *grpc.ClientConn, error) {
@@ -3,4 +3,4 @@
 package aws

 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.43.8"
+const goModuleVersion = "1.47.0"
@@ -1,3 +1,11 @@
+# v1.7.20 (2026-08-26)
+
+* **Dependency Update**: Update to smithy-go v1.28.0.
+
+# v1.7.19 (2026-08-25)
+
+* **Dependency Update**: Update to smithy-go v1.27.10.
+
 # v1.7.18 (2026-08-14)

 * **Dependency Update**: Update to smithy-go v1.27.8.
@@ -3,4 +3,4 @@
 package eventstream

 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.7.18"
+const goModuleVersion = "1.7.20"
@@ -93,6 +93,9 @@ func (r Attempt) logf(logger logging.Logger, classification logging.Classificati
 func (r *Attempt) HandleFinalize(ctx context.Context, in smithymiddle.FinalizeInput, next smithymiddle.FinalizeHandler) (
 	out smithymiddle.FinalizeOutput, metadata smithymiddle.Metadata, err error,
 ) {
+	ctx, span := tracing.StartSpan(ctx, "RetryLoop")
+	defer span.End()
+
 	var attemptClockSkew time.Duration
 	if !r.DisableClockSkewCorrection && r.ClientSkew != nil {
 		attemptClockSkew = time.Duration(r.ClientSkew.Load())
@@ -226,6 +229,11 @@ func (r *Attempt) handleAttempt(
 			service, operation, attemptNum)
 	}

+	// Not an error for other transports: they have no header to set.
+	if req, ok := in.Request.(*http.Request); ok {
+		setRetryMetricsHeader(ctx, req)
+	}
+
 	var metadata smithymiddle.Metadata
 	out, metadata, err = next.HandleFinalize(ctx, in)
 	attemptResult.ResponseMetadata = metadata
@@ -386,14 +394,22 @@ func absDuration(d time.Duration) time.Duration {
 }

 // MetricsHeader attaches SDK request metric header for retries to the transport
+//
+// Deprecated: AWS service clients no longer use this middleware. The
+// Amz-Sdk-Request header is set by the Attempt middleware, which already holds
+// the retry metadata the header describes.
 type MetricsHeader struct{}

 // ID returns the middleware identifier
+//
+// Deprecated: MetricsHeader is deprecated.
 func (r *MetricsHeader) ID() string {
 	return "RetryMetricsHeader"
 }

 // HandleFinalize attaches the SDK request metric header to the transport layer
+//
+// Deprecated: MetricsHeader is deprecated.
 func (r MetricsHeader) HandleFinalize(ctx context.Context, in smithymiddle.FinalizeInput, next smithymiddle.FinalizeHandler) (
 	out smithymiddle.FinalizeOutput, metadata smithymiddle.Metadata, err error,
 ) {
@@ -429,6 +445,34 @@ func (r MetricsHeader) HandleFinalize(ctx context.Context, in smithymiddle.Final
 	return next.HandleFinalize(ctx, in)
 }

+// setRetryMetricsHeader sets the Amz-Sdk-Request header from the retry metadata
+// on the context.
+func setRetryMetricsHeader(ctx context.Context, req *http.Request) {
+	retryMetadata, _ := getRetryMetadata(ctx)
+
+	const retryMetricHeader = "Amz-Sdk-Request"
+	var parts []string
+
+	parts = append(parts, "attempt="+strconv.Itoa(retryMetadata.AttemptNum))
+	if retryMetadata.MaxAttempts != 0 {
+		parts = append(parts, "max="+strconv.Itoa(retryMetadata.MaxAttempts))
+	}
+
+	var ttl time.Time
+	if deadline, ok := ctx.Deadline(); ok {
+		ttl = deadline
+	}
+
+	// Only append the TTL if it can be determined.
+	if !ttl.IsZero() && retryMetadata.AttemptClockSkew > 0 {
+		const unixTimeFormat = "20060102T150405Z"
+		ttl = ttl.Add(retryMetadata.AttemptClockSkew)
+		parts = append(parts, "ttl="+ttl.Format(unixTimeFormat))
+	}
+
+	req.Header[retryMetricHeader] = append(req.Header[retryMetricHeader][:0], strings.Join(parts, "; "))
+}
+
 type retryMetadataKey struct{}

 // getRetryMetadata retrieves retryMetadata from the context and a bool
@@ -471,9 +515,6 @@ func AddRetryMiddlewares(stack *smithymiddle.Stack, options AddRetryMiddlewaresO
 		return err
 	}

-	if err := stack.Finalize.Insert(&MetricsHeader{}, attempt.ID(), smithymiddle.After); err != nil {
-		return err
-	}
 	return nil
 }

@@ -62,6 +62,7 @@ type BuildableClient struct {
 	initOnce sync.Once

 	clientTimeout time.Duration
+	readTimeout   *time.Duration
 	client        *http.Client
 }

@@ -96,9 +97,12 @@ func (b *BuildableClient) Freeze() aws.HTTPClient {
 }

 func (b *BuildableClient) build() {
+	tr := b.GetTransport()
+	b.installReadTimeout(tr)
+
 	b.client = wrapWithLimitedRedirect(&http.Client{
 		Timeout:   b.clientTimeout,
-		Transport: b.GetTransport(),
+		Transport: tr,
 	})
 }

@@ -107,6 +111,7 @@ func (b *BuildableClient) clone() *BuildableClient {
 	cpy.transport = b.GetTransport()
 	cpy.dialer = b.GetDialer()
 	cpy.clientTimeout = b.clientTimeout
+	cpy.readTimeout = b.readTimeout

 	return cpy
 }
@@ -155,6 +160,25 @@ func (b *BuildableClient) WithTimeout(timeout time.Duration) *BuildableClient {
 	return cpy
 }

+// WithReadTimeout copies the BuildableClient and returns it with the read
+// timeout set.
+//
+// The timeout is the maximum time the client waits for a connection to deliver
+// any data. It resets on every byte received, so a slow but progressing response
+// does not fail. It is not a deadline on the operation; use WithTimeout for that.
+//
+// A value set here takes precedence over the SDK's defaults for every service
+// this client is used with, including services the SDK would otherwise apply a
+// higher value to or exempt entirely. Pass 0 to disable read timeouts.
+//
+// The timeout is applied per connection, so a client shared between service
+// clients applies the same value to all of them.
+func (b *BuildableClient) WithReadTimeout(timeout time.Duration) *BuildableClient {
+	cpy := b.clone()
+	cpy.readTimeout = &timeout
+	return cpy
+}
+
 // GetTransport returns a copy of the client's HTTP Transport.
 func (b *BuildableClient) GetTransport() *http.Transport {
 	var tr *http.Transport
@@ -184,6 +208,17 @@ func (b *BuildableClient) GetTimeout() time.Duration {
 	return b.clientTimeout
 }

+// GetReadTimeout returns the configured read timeout and whether one was set on
+// this client. When it was not, the SDK resolves a default per
+// service.
+func (b *BuildableClient) GetReadTimeout() (time.Duration, bool) {
+	if b.readTimeout == nil {
+		return 0, false
+	}
+
+	return *b.readTimeout, true
+}
+
 func defaultDialer() *net.Dialer {
 	return &net.Dialer{
 		Timeout:   DefaultDialConnectTimeout,
@@ -0,0 +1,54 @@
+package http
+
+import (
+	"context"
+	"errors"
+	"net"
+	"net/http"
+	"os"
+	"time"
+)
+
+// deadlineConn applies a rolling inactivity window to reads on a connection by
+// resetting the read deadline before each one. A read returns as soon as any
+// bytes are available, so a slow but progressing transfer survives, and a
+// connection that goes silent fails once.
+type deadlineConn struct {
+	net.Conn
+	timeout time.Duration
+}
+
+// Read implements [io.Reader].
+func (c *deadlineConn) Read(p []byte) (int, error) {
+	if err := c.Conn.SetReadDeadline(time.Now().Add(c.timeout)); err != nil {
+		return 0, err
+	}
+
+	n, err := c.Conn.Read(p)
+	if errors.Is(err, os.ErrDeadlineExceeded) {
+		return n, &ResponseTimeoutError{TimeoutDur: c.timeout}
+	}
+
+	return n, err
+}
+
+func (b *BuildableClient) installReadTimeout(tr *http.Transport) {
+	timeout, ok := b.GetReadTimeout()
+	if !ok || timeout <= 0 {
+		return
+	}
+
+	dial := tr.DialContext
+	if dial == nil {
+		dial = defaultDialer().DialContext
+	}
+
+	tr.DialContext = func(ctx context.Context, network, addr string) (net.Conn, error) {
+		conn, err := dial(ctx, network, addr)
+		if err != nil {
+			return nil, err
+		}
+
+		return &deadlineConn{Conn: conn, timeout: timeout}, nil
+	}
+}
@@ -1,3 +1,29 @@
+# v1.33.4 (2026-09-09)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.33.3 (2026-09-04)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.33.2 (2026-08-31.2)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.33.1 (2026-08-28)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.33.0 (2026-08-27)
+
+* **Feature**: Support connection read timeouts in the SDK. This is currently available on an opt-in basis by setting env `AWS_ENABLE_DEFAULT_SOCKET_TIMEOUT_2026=true`.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.32.40 (2026-08-26)
+
+* **Dependency Update**: Update to smithy-go v1.28.0.
+* **Dependency Update**: Updated to the latest SDK module versions
+
 # v1.32.39 (2026-08-25)

 * **Dependency Update**: Update to smithy-go v1.27.10.
@@ -3,4 +3,4 @@
 package config

 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.32.39"
+const goModuleVersion = "1.33.4"
@@ -1,3 +1,29 @@
+# v1.20.4 (2026-09-09)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.20.3 (2026-09-04)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.20.2 (2026-08-31.2)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.20.1 (2026-08-28)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.20.0 (2026-08-27)
+
+* **Feature**: Support connection read timeouts in the SDK. This is currently available on an opt-in basis by setting env `AWS_ENABLE_DEFAULT_SOCKET_TIMEOUT_2026=true`.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.19.39 (2026-08-26)
+
+* **Dependency Update**: Update to smithy-go v1.28.0.
+* **Dependency Update**: Updated to the latest SDK module versions
+
 # v1.19.38 (2026-08-25)

 * **Dependency Update**: Update to smithy-go v1.27.10.
@@ -3,4 +3,4 @@
 package credentials

 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.19.38"
+const goModuleVersion = "1.20.4"
@@ -1,3 +1,26 @@
+# v1.20.0 (2026-09-09)
+
+* **Feature**: Stop registering the `retry.MetricsHeader` middleware in generated clients. The `Amz-Sdk-Request` header is now set by the retry middleware itself.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.19.2 (2026-09-04)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.19.1 (2026-08-28)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.19.0 (2026-08-27)
+
+* **Feature**: Support connection read timeouts in the SDK. This is currently available on an opt-in basis by setting env `AWS_ENABLE_DEFAULT_SOCKET_TIMEOUT_2026=true`.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.18.40 (2026-08-26)
+
+* **Dependency Update**: Update to smithy-go v1.28.0.
+* **Dependency Update**: Updated to the latest SDK module versions
+
 # v1.18.39 (2026-08-25)

 * **Dependency Update**: Update to smithy-go v1.27.10.
@@ -3,4 +3,4 @@
 package imds

 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.18.39"
+const goModuleVersion = "1.20.0"
@@ -1,3 +1,25 @@
+# v1.5.3 (2026-09-09)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.5.2 (2026-09-04)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.5.1 (2026-08-28)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.5.0 (2026-08-27)
+
+* **Feature**: Support connection read timeouts in the SDK. This is currently available on an opt-in basis by setting env `AWS_ENABLE_DEFAULT_SOCKET_TIMEOUT_2026=true`.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.4.40 (2026-08-26)
+
+* **Dependency Update**: Update to smithy-go v1.28.0.
+* **Dependency Update**: Updated to the latest SDK module versions
+
 # v1.4.39 (2026-08-25)

 * **Dependency Update**: Update to smithy-go v1.27.10.
@@ -3,4 +3,4 @@
 package configsources

 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.4.39"
+const goModuleVersion = "1.5.3"
@@ -1,3 +1,25 @@
+# v2.8.3 (2026-09-09)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v2.8.2 (2026-09-04)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v2.8.1 (2026-08-28)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v2.8.0 (2026-08-27)
+
+* **Feature**: Support connection read timeouts in the SDK. This is currently available on an opt-in basis by setting env `AWS_ENABLE_DEFAULT_SOCKET_TIMEOUT_2026=true`.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v2.7.40 (2026-08-26)
+
+* **Dependency Update**: Update to smithy-go v1.28.0.
+* **Dependency Update**: Updated to the latest SDK module versions
+
 # v2.7.39 (2026-08-25)

 * **Dependency Update**: Update to smithy-go v1.27.10.
@@ -3,4 +3,4 @@
 package endpoints

 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "2.7.39"
+const goModuleVersion = "2.8.3"
@@ -0,0 +1,6 @@
+package timeouts
+
+// Enabled internally.
+var enableReadTimeout2026 = false
+
+var readTimeout2026Rollout map[string]bool
@@ -0,0 +1,39 @@
+package timeouts
+
+import (
+	"os"
+	"sync"
+	"time"
+)
+
+// DefaultReadTimeout is the SDK's default read timeout for a service with no
+// entry in serviceInactivityTimeoutMillis.
+const DefaultReadTimeout = 5 * time.Minute
+
+const enableReadTimeoutEnvVar = "AWS_ENABLE_DEFAULT_SOCKET_TIMEOUT_2026"
+
+var enableFromEnv = sync.OnceValue(func() bool {
+	return os.Getenv(enableReadTimeoutEnvVar) == "true"
+})
+
+// GetServiceReadTimeout reports the SDK's default read timeout for a service,
+// and whether one applies.
+func GetServiceReadTimeout(serviceID string) (time.Duration, bool) {
+	if enableReadTimeout2026 {
+		if !readTimeout2026Rollout[serviceID] {
+			return 0, false
+		}
+	} else if !enableFromEnv() {
+		return 0, false
+	}
+
+	ms, ok := serviceInactivityTimeoutMillis[serviceID]
+	if !ok {
+		return DefaultReadTimeout, true
+	}
+	if ms < 0 {
+		return 0, false
+	}
+
+	return time.Duration(ms) * time.Millisecond, true
+}
@@ -0,0 +1,102 @@
+// Code generated from the connection read timeout risk mitigation
+// document's exemption table. DO NOT EDIT.
+
+package timeouts
+
+// serviceInactivityTimeoutMillis overrides the default read timeout for
+// services whose operations legitimately hold a connection open, keyed by
+// ServiceID. A negative value means the service is fully exempt and gets no
+// timeout.
+//
+// Services absent from this map get DefaultReadTimeout.
+var serviceInactivityTimeoutMillis = map[string]int64{
+	// Fully exempt: an operation takes an event stream or a streaming blob as
+	// input. The caller controls how long the request takes, and no response
+	// arrives until it finishes, so a read timeout would fire on the duration of
+	// the caller's own upload rather than on a network problem.
+	"Bedrock Runtime":         -1,
+	"CloudSearch Domain":      -1,
+	"ConnectHealth":           -1,
+	"EBS":                     -1,
+	"Glacier":                 -1,
+	"Lambda":                  -1,
+	"Lex Runtime Service":     -1,
+	"Lex Runtime V2":          -1,
+	"MediaStore Data":         -1,
+	"Omics":                   -1,
+	"Polly":                   -1,
+	"QBusiness":               -1,
+	"S3":                      -1,
+	"SageMaker Runtime HTTP2": -1,
+	"Transcribe Streaming":    -1,
+	"codeartifact":            -1,
+
+	// Long-hold operations: a higher ceiling rather than no ceiling.
+	"API Gateway":                     900000,
+	"ApiGatewayV2":                    900000,
+	"AppIntegrations":                 900000,
+	"AppStream":                       900000,
+	"Athena":                          900000,
+	"Auto Scaling":                    900000,
+	"Batch":                           900000,
+	"Bedrock":                         900000,
+	"Bedrock Agent":                   900000,
+	"Bedrock Agent Runtime":           900000,
+	"Bedrock AgentCore":               900000,
+	"Bedrock AgentCore Control":       900000,
+	"Bedrock Data Automation Runtime": 900000,
+	"CloudFormation":                  900000,
+	"CloudWatch":                      900000,
+	"CodeBuild":                       900000,
+	"CodeCatalyst":                    900000,
+	"CodeDeploy":                      900000,
+	"Config Service":                  900000,
+	"Connect":                         900000,
+	"Data Pipeline":                   900000,
+	"DataBrew":                        900000,
+	"DataExchange":                    900000,
+	"DataZone":                        900000,
+	"Device Farm":                     900000,
+	"EC2":                             900000,
+	"ECS":                             900000,
+	"EMR Serverless":                  900000,
+	"Elastic Load Balancing v2":       900000,
+	"GameLift":                        900000,
+	"GameLiftStreams":                 900000,
+	"Glue":                            900000,
+	"IoT":                             900000,
+	"IoT Data Plane":                  900000,
+	"IoT Jobs Data Plane":             900000,
+	"IoTSecureTunneling":              900000,
+	"Kinesis":                         900000,
+	"Kinesis Analytics V2":            900000,
+	"Kinesis Video Archived Media":    900000,
+	"Kinesis Video Media":             900000,
+	"Kinesis Video Signaling":         900000,
+	"Kinesis Video WebRTC Storage":    900000,
+	"Lex Model Building Service":      900000,
+	"Lex Models V2":                   900000,
+	"Neptune Graph":                   900000,
+	"Nova Act":                        900000,
+	"QApps":                           900000,
+	"QConnect":                        900000,
+	"QuickSight":                      900000,
+	"RDS":                             900000,
+	"RDS Data":                        900000,
+	"RTBFabric":                       900000,
+	"SFN":                             900000,
+	"SQS":                             900000,
+	"SSM":                             900000,
+	"SWF":                             900000,
+	"SageMaker":                       900000,
+	"SageMaker Runtime":               900000,
+	"SagemakerJobRuntime":             900000,
+	"Storage Gateway":                 900000,
+	"Timestream Query":                900000,
+	"Wisdom":                          900000,
+	"WorkSpaces":                      900000,
+	"WorkSpaces Web":                  900000,
+	"b2bi":                            900000,
+	"mgn":                             900000,
+	"neptunedata":                     900000,
+}
@@ -1,3 +1,25 @@
+# v1.5.3 (2026-09-09)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.5.2 (2026-09-04)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.5.1 (2026-08-28)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.5.0 (2026-08-27)
+
+* **Feature**: Support connection read timeouts in the SDK. This is currently available on an opt-in basis by setting env `AWS_ENABLE_DEFAULT_SOCKET_TIMEOUT_2026=true`.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.4.41 (2026-08-26)
+
+* **Dependency Update**: Update to smithy-go v1.28.0.
+* **Dependency Update**: Updated to the latest SDK module versions
+
 # v1.4.40 (2026-08-25)

 * **Dependency Update**: Update to smithy-go v1.27.10.
@@ -3,4 +3,4 @@
 package v4a

 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.4.40"
+const goModuleVersion = "1.5.3"
@@ -1,3 +1,7 @@
+# v1.13.19 (2026-08-26)
+
+* **Dependency Update**: Update to smithy-go v1.28.0.
+
 # v1.13.18 (2026-08-25)

 * **Dependency Update**: Update to smithy-go v1.27.10.
@@ -3,4 +3,4 @@
 package acceptencoding

 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.13.18"
+const goModuleVersion = "1.13.19"
@@ -1,3 +1,25 @@
+# v1.14.3 (2026-09-09)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.14.2 (2026-09-04)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.14.1 (2026-08-28)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.14.0 (2026-08-27)
+
+* **Feature**: Support connection read timeouts in the SDK. This is currently available on an opt-in basis by setting env `AWS_ENABLE_DEFAULT_SOCKET_TIMEOUT_2026=true`.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.13.40 (2026-08-26)
+
+* **Dependency Update**: Update to smithy-go v1.28.0.
+* **Dependency Update**: Updated to the latest SDK module versions
+
 # v1.13.39 (2026-08-25)

 * **Dependency Update**: Update to smithy-go v1.27.10.
@@ -3,4 +3,4 @@
 package presignedurl

 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.13.39"
+const goModuleVersion = "1.14.3"
@@ -1,3 +1,32 @@
+# v1.10.0 (2026-09-09)
+
+* **Feature**: Stop registering the `retry.MetricsHeader` middleware in generated clients. The `Amz-Sdk-Request` header is now set by the retry middleware itself.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.9.0 (2026-09-04)
+
+* **Feature**: Stop registering the `spanRetryLoop` middleware in generated clients. The retry loop's tracing span is now opened by the retry middleware itself.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.8.0 (2026-08-31.2)
+
+* **Feature**: Stop registering the `SetCredentialSourceMiddleware` middleware in generated clients. Credential source user agent features are now set when the client's middleware stack is constructed.
+
+# v1.7.1 (2026-08-28)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.7.0 (2026-08-27)
+
+* **Feature**: Support connection read timeouts in the SDK. This is currently available on an opt-in basis by setting env `AWS_ENABLE_DEFAULT_SOCKET_TIMEOUT_2026=true`.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.6.0 (2026-08-26)
+
+* **Feature**: Stop registering the `ComputeContentLength` middleware in generated clients. `Content-Length` is now set when the request body is set via `SetStream`.
+* **Dependency Update**: Update to smithy-go v1.28.0.
+* **Dependency Update**: Updated to the latest SDK module versions
+
 # v1.5.8 (2026-08-25)

 * **Dependency Update**: Update to smithy-go v1.27.10.
@@ -16,6 +16,7 @@ import (
 	internalauth "github.com/aws/aws-sdk-go-v2/internal/auth"
 	internalauthsmithy "github.com/aws/aws-sdk-go-v2/internal/auth/smithy"
 	internalConfig "github.com/aws/aws-sdk-go-v2/internal/configsources"
+	"github.com/aws/aws-sdk-go-v2/internal/timeouts"
 	smithy "github.com/aws/smithy-go"
 	smithydocument "github.com/aws/smithy-go/document"
 	"github.com/aws/smithy-go/logging"
@@ -392,9 +393,6 @@ func (c *Client) addCommonMiddlewares(stack *middleware.Stack, options Options,
 	if err := addRawResponseToMetadata(stack); err != nil {
 		return err
 	}
-	if err := addSpanRetryLoop(stack, options); err != nil {
-		return err
-	}
 	if err := addClientUserAgent(stack, options); err != nil {
 		return err
 	}
@@ -523,6 +521,12 @@ func resolveHTTPClient(o *Options) {
 		})
 	}

+	if _, ok := buildable.GetReadTimeout(); !ok {
+		if timeout, ok := timeouts.GetServiceReadTimeout(ServiceID); ok {
+			buildable = buildable.WithReadTimeout(timeout)
+		}
+	}
+
 	o.HTTPClient = buildable
 }

@@ -664,10 +668,6 @@ func addClientRequestID(stack *middleware.Stack) error {
 	return stack.Build.Add(&awsmiddleware.ClientRequestID{}, middleware.After)
 }

-func addComputeContentLength(stack *middleware.Stack) error {
-	return stack.Build.Insert(&smithyhttp.ComputeContentLength{}, "ClientRequestID", middleware.After)
-}
-
 func addRawResponseToMetadata(stack *middleware.Stack) error {
 	return stack.Deserialize.Add(&awsmiddleware.AddRawResponse{}, middleware.Before)
 }
@@ -677,30 +677,6 @@ func addRecordResponseTiming(stack *middleware.Stack, options Options) error {
 		DisableClockSkewCorrection: options.DisableClockSkewCorrection,
 	}, middleware.After)
 }
-
-func addSpanRetryLoop(stack *middleware.Stack, options Options) error {
-	return stack.Finalize.Insert(&spanRetryLoop{options: options}, "Retry", middleware.Before)
-}
-
-type spanRetryLoop struct {
-	options Options
-}
-
-func (*spanRetryLoop) ID() string {
-	return "spanRetryLoop"
-}
-
-func (m *spanRetryLoop) HandleFinalize(
-	ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler,
-) (
-	middleware.FinalizeOutput, middleware.Metadata, error,
-) {
-	tracer := operationTracer(m.options.TracerProvider)
-	ctx, span := tracer.StartSpan(ctx, "RetryLoop")
-	defer span.End()
-
-	return next.HandleFinalize(ctx, in)
-}
 func addStreamingEventsPayload(stack *middleware.Stack) error {
 	return stack.Finalize.Add(&v4.StreamingEventsPayload{}, middleware.Before)
 }
@@ -758,9 +734,6 @@ func addRetry(stack *middleware.Stack, o Options, c *Client) error {
 	if err := stack.Finalize.Insert(attempt, "ResolveAuthScheme", middleware.Before); err != nil {
 		return err
 	}
-	if err := stack.Finalize.Insert(&retry.MetricsHeader{}, attempt.ID(), middleware.After); err != nil {
-		return err
-	}
 	return nil
 }

@@ -813,35 +786,21 @@ func addUserAgentRetryMode(stack *middleware.Stack, options Options) error {
 	return nil
 }

-type setCredentialSourceMiddleware struct {
-	ua      *awsmiddleware.RequestUserAgent
-	options Options
-}
-
-func (m setCredentialSourceMiddleware) ID() string { return "SetCredentialSourceMiddleware" }
-
-func (m setCredentialSourceMiddleware) HandleBuild(ctx context.Context, in middleware.BuildInput, next middleware.BuildHandler) (
-	out middleware.BuildOutput, metadata middleware.Metadata, err error,
-) {
-	asProviderSource, ok := m.options.Credentials.(aws.CredentialProviderSource)
-	if !ok {
-		return next.HandleBuild(ctx, in)
-	}
-	providerSources := asProviderSource.ProviderSources()
-	for _, source := range providerSources {
-		m.ua.AddCredentialsSource(source)
-	}
-	return next.HandleBuild(ctx, in)
-}
-
 func addCredentialSource(stack *middleware.Stack, options Options) error {
 	ua, err := getOrAddRequestUserAgent(stack)
 	if err != nil {
 		return err
 	}

-	mw := setCredentialSourceMiddleware{ua: ua, options: options}
-	return stack.Build.Insert(&mw, "UserAgent", middleware.Before)
+	asProviderSource, ok := options.Credentials.(aws.CredentialProviderSource)
+	if !ok {
+		return nil
+	}
+
+	for _, source := range asProviderSource.ProviderSources() {
+		ua.AddCredentialsSource(source)
+	}
+	return nil
 }

 func resolveTracerProvider(options *Options) {
@@ -116,9 +116,6 @@ func (c *Client) addOperationCreateOAuth2TokenMiddlewares(stack *middleware.Stac
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -84,9 +84,6 @@ func (c *Client) addOperationCreateOAuth2TokenWithIAMMiddlewares(stack *middlewa
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -72,9 +72,6 @@ func (c *Client) addOperationDeleteConsoleAuthorizationConfigurationMiddlewares(
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -62,9 +62,6 @@ func (c *Client) addOperationDeleteResourcePermissionStatementMiddlewares(stack
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -72,9 +72,6 @@ func (c *Client) addOperationGetConsoleAuthorizationConfigurationMiddlewares(sta
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -59,9 +59,6 @@ func (c *Client) addOperationGetResourcePolicyMiddlewares(stack *middleware.Stac
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -134,9 +134,6 @@ func (c *Client) addOperationIntrospectOAuth2TokenWithIAMMiddlewares(stack *midd
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -70,9 +70,6 @@ func (c *Client) addOperationListResourcePermissionStatementsMiddlewares(stack *
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -72,9 +72,6 @@ func (c *Client) addOperationPutConsoleAuthorizationConfigurationMiddlewares(sta
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -85,9 +85,6 @@ func (c *Client) addOperationPutResourcePermissionStatementMiddlewares(stack *mi
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -72,9 +72,6 @@ func (c *Client) addOperationRevokeOAuth2TokenWithIAMMiddlewares(stack *middlewa
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -3,4 +3,4 @@
 package signin

 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.5.8"
+const goModuleVersion = "1.10.0"
@@ -1,3 +1,32 @@
+# v1.38.0 (2026-09-09)
+
+* **Feature**: Stop registering the `retry.MetricsHeader` middleware in generated clients. The `Amz-Sdk-Request` header is now set by the retry middleware itself.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.37.0 (2026-09-04)
+
+* **Feature**: Stop registering the `spanRetryLoop` middleware in generated clients. The retry loop's tracing span is now opened by the retry middleware itself.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.36.0 (2026-08-31.2)
+
+* **Feature**: Stop registering the `SetCredentialSourceMiddleware` middleware in generated clients. Credential source user agent features are now set when the client's middleware stack is constructed.
+
+# v1.35.1 (2026-08-28)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.35.0 (2026-08-27)
+
+* **Feature**: Support connection read timeouts in the SDK. This is currently available on an opt-in basis by setting env `AWS_ENABLE_DEFAULT_SOCKET_TIMEOUT_2026=true`.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.34.0 (2026-08-26)
+
+* **Feature**: Stop registering the `ComputeContentLength` middleware in generated clients. `Content-Length` is now set when the request body is set via `SetStream`.
+* **Dependency Update**: Update to smithy-go v1.28.0.
+* **Dependency Update**: Updated to the latest SDK module versions
+
 # v1.33.8 (2026-08-25)

 * **Dependency Update**: Update to smithy-go v1.27.10.
@@ -15,6 +15,7 @@ import (
 	internalauth "github.com/aws/aws-sdk-go-v2/internal/auth"
 	internalauthsmithy "github.com/aws/aws-sdk-go-v2/internal/auth/smithy"
 	internalConfig "github.com/aws/aws-sdk-go-v2/internal/configsources"
+	"github.com/aws/aws-sdk-go-v2/internal/timeouts"
 	smithy "github.com/aws/smithy-go"
 	smithydocument "github.com/aws/smithy-go/document"
 	"github.com/aws/smithy-go/logging"
@@ -388,9 +389,6 @@ func (c *Client) addCommonMiddlewares(stack *middleware.Stack, options Options,
 	if err := addRawResponseToMetadata(stack); err != nil {
 		return err
 	}
-	if err := addSpanRetryLoop(stack, options); err != nil {
-		return err
-	}
 	if err := addClientUserAgent(stack, options); err != nil {
 		return err
 	}
@@ -519,6 +517,12 @@ func resolveHTTPClient(o *Options) {
 		})
 	}

+	if _, ok := buildable.GetReadTimeout(); !ok {
+		if timeout, ok := timeouts.GetServiceReadTimeout(ServiceID); ok {
+			buildable = buildable.WithReadTimeout(timeout)
+		}
+	}
+
 	o.HTTPClient = buildable
 }

@@ -660,10 +664,6 @@ func addClientRequestID(stack *middleware.Stack) error {
 	return stack.Build.Add(&awsmiddleware.ClientRequestID{}, middleware.After)
 }

-func addComputeContentLength(stack *middleware.Stack) error {
-	return stack.Build.Insert(&smithyhttp.ComputeContentLength{}, "ClientRequestID", middleware.After)
-}
-
 func addRawResponseToMetadata(stack *middleware.Stack) error {
 	return stack.Deserialize.Add(&awsmiddleware.AddRawResponse{}, middleware.Before)
 }
@@ -673,30 +673,6 @@ func addRecordResponseTiming(stack *middleware.Stack, options Options) error {
 		DisableClockSkewCorrection: options.DisableClockSkewCorrection,
 	}, middleware.After)
 }
-
-func addSpanRetryLoop(stack *middleware.Stack, options Options) error {
-	return stack.Finalize.Insert(&spanRetryLoop{options: options}, "Retry", middleware.Before)
-}
-
-type spanRetryLoop struct {
-	options Options
-}
-
-func (*spanRetryLoop) ID() string {
-	return "spanRetryLoop"
-}
-
-func (m *spanRetryLoop) HandleFinalize(
-	ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler,
-) (
-	middleware.FinalizeOutput, middleware.Metadata, error,
-) {
-	tracer := operationTracer(m.options.TracerProvider)
-	ctx, span := tracer.StartSpan(ctx, "RetryLoop")
-	defer span.End()
-
-	return next.HandleFinalize(ctx, in)
-}
 func addStreamingEventsPayload(stack *middleware.Stack) error {
 	return stack.Finalize.Add(&v4.StreamingEventsPayload{}, middleware.Before)
 }
@@ -747,9 +723,6 @@ func addRetry(stack *middleware.Stack, o Options, c *Client) error {
 	if err := stack.Finalize.Insert(attempt, "ResolveAuthScheme", middleware.Before); err != nil {
 		return err
 	}
-	if err := stack.Finalize.Insert(&retry.MetricsHeader{}, attempt.ID(), middleware.After); err != nil {
-		return err
-	}
 	return nil
 }

@@ -802,35 +775,21 @@ func addUserAgentRetryMode(stack *middleware.Stack, options Options) error {
 	return nil
 }

-type setCredentialSourceMiddleware struct {
-	ua      *awsmiddleware.RequestUserAgent
-	options Options
-}
-
-func (m setCredentialSourceMiddleware) ID() string { return "SetCredentialSourceMiddleware" }
-
-func (m setCredentialSourceMiddleware) HandleBuild(ctx context.Context, in middleware.BuildInput, next middleware.BuildHandler) (
-	out middleware.BuildOutput, metadata middleware.Metadata, err error,
-) {
-	asProviderSource, ok := m.options.Credentials.(aws.CredentialProviderSource)
-	if !ok {
-		return next.HandleBuild(ctx, in)
-	}
-	providerSources := asProviderSource.ProviderSources()
-	for _, source := range providerSources {
-		m.ua.AddCredentialsSource(source)
-	}
-	return next.HandleBuild(ctx, in)
-}
-
 func addCredentialSource(stack *middleware.Stack, options Options) error {
 	ua, err := getOrAddRequestUserAgent(stack)
 	if err != nil {
 		return err
 	}

-	mw := setCredentialSourceMiddleware{ua: ua, options: options}
-	return stack.Build.Insert(&mw, "UserAgent", middleware.Before)
+	asProviderSource, ok := options.Credentials.(aws.CredentialProviderSource)
+	if !ok {
+		return nil
+	}
+
+	for _, source := range asProviderSource.ProviderSources() {
+		ua.AddCredentialsSource(source)
+	}
+	return nil
 }

 func resolveTracerProvider(options *Options) {
@@ -69,9 +69,6 @@ func (c *Client) addOperationGetRoleCredentialsMiddlewares(stack *middleware.Sta
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -75,9 +75,6 @@ func (c *Client) addOperationListAccountRolesMiddlewares(stack *middleware.Stack
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -74,9 +74,6 @@ func (c *Client) addOperationListAccountsMiddlewares(stack *middleware.Stack, op
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -68,9 +68,6 @@ func (c *Client) addOperationLogoutMiddlewares(stack *middleware.Stack, options
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -3,4 +3,4 @@
 package sso

 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.33.8"
+const goModuleVersion = "1.38.0"
@@ -1,3 +1,32 @@
+# v1.43.0 (2026-09-09)
+
+* **Feature**: Stop registering the `retry.MetricsHeader` middleware in generated clients. The `Amz-Sdk-Request` header is now set by the retry middleware itself.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.42.0 (2026-09-04)
+
+* **Feature**: Stop registering the `spanRetryLoop` middleware in generated clients. The retry loop's tracing span is now opened by the retry middleware itself.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.41.0 (2026-08-31.2)
+
+* **Feature**: Stop registering the `SetCredentialSourceMiddleware` middleware in generated clients. Credential source user agent features are now set when the client's middleware stack is constructed.
+
+# v1.40.1 (2026-08-28)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.40.0 (2026-08-27)
+
+* **Feature**: Support connection read timeouts in the SDK. This is currently available on an opt-in basis by setting env `AWS_ENABLE_DEFAULT_SOCKET_TIMEOUT_2026=true`.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.39.0 (2026-08-26)
+
+* **Feature**: Stop registering the `ComputeContentLength` middleware in generated clients. `Content-Length` is now set when the request body is set via `SetStream`.
+* **Dependency Update**: Update to smithy-go v1.28.0.
+* **Dependency Update**: Updated to the latest SDK module versions
+
 # v1.38.8 (2026-08-25)

 * **Dependency Update**: Update to smithy-go v1.27.10.
@@ -15,6 +15,7 @@ import (
 	internalauth "github.com/aws/aws-sdk-go-v2/internal/auth"
 	internalauthsmithy "github.com/aws/aws-sdk-go-v2/internal/auth/smithy"
 	internalConfig "github.com/aws/aws-sdk-go-v2/internal/configsources"
+	"github.com/aws/aws-sdk-go-v2/internal/timeouts"
 	smithy "github.com/aws/smithy-go"
 	smithydocument "github.com/aws/smithy-go/document"
 	"github.com/aws/smithy-go/logging"
@@ -388,9 +389,6 @@ func (c *Client) addCommonMiddlewares(stack *middleware.Stack, options Options,
 	if err := addRawResponseToMetadata(stack); err != nil {
 		return err
 	}
-	if err := addSpanRetryLoop(stack, options); err != nil {
-		return err
-	}
 	if err := addClientUserAgent(stack, options); err != nil {
 		return err
 	}
@@ -519,6 +517,12 @@ func resolveHTTPClient(o *Options) {
 		})
 	}

+	if _, ok := buildable.GetReadTimeout(); !ok {
+		if timeout, ok := timeouts.GetServiceReadTimeout(ServiceID); ok {
+			buildable = buildable.WithReadTimeout(timeout)
+		}
+	}
+
 	o.HTTPClient = buildable
 }

@@ -660,10 +664,6 @@ func addClientRequestID(stack *middleware.Stack) error {
 	return stack.Build.Add(&awsmiddleware.ClientRequestID{}, middleware.After)
 }

-func addComputeContentLength(stack *middleware.Stack) error {
-	return stack.Build.Insert(&smithyhttp.ComputeContentLength{}, "ClientRequestID", middleware.After)
-}
-
 func addRawResponseToMetadata(stack *middleware.Stack) error {
 	return stack.Deserialize.Add(&awsmiddleware.AddRawResponse{}, middleware.Before)
 }
@@ -673,30 +673,6 @@ func addRecordResponseTiming(stack *middleware.Stack, options Options) error {
 		DisableClockSkewCorrection: options.DisableClockSkewCorrection,
 	}, middleware.After)
 }
-
-func addSpanRetryLoop(stack *middleware.Stack, options Options) error {
-	return stack.Finalize.Insert(&spanRetryLoop{options: options}, "Retry", middleware.Before)
-}
-
-type spanRetryLoop struct {
-	options Options
-}
-
-func (*spanRetryLoop) ID() string {
-	return "spanRetryLoop"
-}
-
-func (m *spanRetryLoop) HandleFinalize(
-	ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler,
-) (
-	middleware.FinalizeOutput, middleware.Metadata, error,
-) {
-	tracer := operationTracer(m.options.TracerProvider)
-	ctx, span := tracer.StartSpan(ctx, "RetryLoop")
-	defer span.End()
-
-	return next.HandleFinalize(ctx, in)
-}
 func addStreamingEventsPayload(stack *middleware.Stack) error {
 	return stack.Finalize.Add(&v4.StreamingEventsPayload{}, middleware.Before)
 }
@@ -747,9 +723,6 @@ func addRetry(stack *middleware.Stack, o Options, c *Client) error {
 	if err := stack.Finalize.Insert(attempt, "ResolveAuthScheme", middleware.Before); err != nil {
 		return err
 	}
-	if err := stack.Finalize.Insert(&retry.MetricsHeader{}, attempt.ID(), middleware.After); err != nil {
-		return err
-	}
 	return nil
 }

@@ -802,35 +775,21 @@ func addUserAgentRetryMode(stack *middleware.Stack, options Options) error {
 	return nil
 }

-type setCredentialSourceMiddleware struct {
-	ua      *awsmiddleware.RequestUserAgent
-	options Options
-}
-
-func (m setCredentialSourceMiddleware) ID() string { return "SetCredentialSourceMiddleware" }
-
-func (m setCredentialSourceMiddleware) HandleBuild(ctx context.Context, in middleware.BuildInput, next middleware.BuildHandler) (
-	out middleware.BuildOutput, metadata middleware.Metadata, err error,
-) {
-	asProviderSource, ok := m.options.Credentials.(aws.CredentialProviderSource)
-	if !ok {
-		return next.HandleBuild(ctx, in)
-	}
-	providerSources := asProviderSource.ProviderSources()
-	for _, source := range providerSources {
-		m.ua.AddCredentialsSource(source)
-	}
-	return next.HandleBuild(ctx, in)
-}
-
 func addCredentialSource(stack *middleware.Stack, options Options) error {
 	ua, err := getOrAddRequestUserAgent(stack)
 	if err != nil {
 		return err
 	}

-	mw := setCredentialSourceMiddleware{ua: ua, options: options}
-	return stack.Build.Insert(&mw, "UserAgent", middleware.Before)
+	asProviderSource, ok := options.Credentials.(aws.CredentialProviderSource)
+	if !ok {
+		return nil
+	}
+
+	for _, source := range asProviderSource.ProviderSources() {
+		ua.AddCredentialsSource(source)
+	}
+	return nil
 }

 func resolveTracerProvider(options *Options) {
@@ -139,9 +139,6 @@ func (c *Client) addOperationCreateTokenMiddlewares(stack *middleware.Stack, opt
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -183,9 +183,6 @@ func (c *Client) addOperationCreateTokenWithIAMMiddlewares(stack *middleware.Sta
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -110,9 +110,6 @@ func (c *Client) addOperationRegisterClientMiddlewares(stack *middleware.Stack,
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -92,9 +92,6 @@ func (c *Client) addOperationStartDeviceAuthorizationMiddlewares(stack *middlewa
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -3,4 +3,4 @@
 package ssooidc

 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.38.8"
+const goModuleVersion = "1.43.0"
@@ -1,3 +1,32 @@
+# v1.50.0 (2026-09-09)
+
+* **Feature**: Stop registering the `retry.MetricsHeader` middleware in generated clients. The `Amz-Sdk-Request` header is now set by the retry middleware itself.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.49.0 (2026-09-04)
+
+* **Feature**: Stop registering the `spanRetryLoop` middleware in generated clients. The retry loop's tracing span is now opened by the retry middleware itself.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.48.0 (2026-08-31.2)
+
+* **Feature**: Stop registering the `SetCredentialSourceMiddleware` middleware in generated clients. Credential source user agent features are now set when the client's middleware stack is constructed.
+
+# v1.47.1 (2026-08-28)
+
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.47.0 (2026-08-27)
+
+* **Feature**: Support connection read timeouts in the SDK. This is currently available on an opt-in basis by setting env `AWS_ENABLE_DEFAULT_SOCKET_TIMEOUT_2026=true`.
+* **Dependency Update**: Updated to the latest SDK module versions
+
+# v1.46.0 (2026-08-26)
+
+* **Feature**: Stop registering the `ComputeContentLength` middleware in generated clients. `Content-Length` is now set when the request body is set via `SetStream`.
+* **Dependency Update**: Update to smithy-go v1.28.0.
+* **Dependency Update**: Updated to the latest SDK module versions
+
 # v1.45.8 (2026-08-25)

 * **Dependency Update**: Update to smithy-go v1.27.10.
@@ -16,6 +16,7 @@ import (
 	internalauth "github.com/aws/aws-sdk-go-v2/internal/auth"
 	internalauthsmithy "github.com/aws/aws-sdk-go-v2/internal/auth/smithy"
 	internalConfig "github.com/aws/aws-sdk-go-v2/internal/configsources"
+	"github.com/aws/aws-sdk-go-v2/internal/timeouts"
 	"github.com/aws/aws-sdk-go-v2/internal/v4a"
 	acceptencodingcust "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding"
 	presignedurlcust "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url"
@@ -397,9 +398,6 @@ func (c *Client) addCommonMiddlewares(stack *middleware.Stack, options Options,
 	if err := addRawResponseToMetadata(stack); err != nil {
 		return err
 	}
-	if err := addSpanRetryLoop(stack, options); err != nil {
-		return err
-	}
 	if err := addClientUserAgent(stack, options); err != nil {
 		return err
 	}
@@ -533,6 +531,12 @@ func resolveHTTPClient(o *Options) {
 		})
 	}

+	if _, ok := buildable.GetReadTimeout(); !ok {
+		if timeout, ok := timeouts.GetServiceReadTimeout(ServiceID); ok {
+			buildable = buildable.WithReadTimeout(timeout)
+		}
+	}
+
 	o.HTTPClient = buildable
 }

@@ -674,10 +678,6 @@ func addClientRequestID(stack *middleware.Stack) error {
 	return stack.Build.Add(&awsmiddleware.ClientRequestID{}, middleware.After)
 }

-func addComputeContentLength(stack *middleware.Stack) error {
-	return stack.Build.Insert(&smithyhttp.ComputeContentLength{}, "ClientRequestID", middleware.After)
-}
-
 func addRawResponseToMetadata(stack *middleware.Stack) error {
 	return stack.Deserialize.Add(&awsmiddleware.AddRawResponse{}, middleware.Before)
 }
@@ -687,30 +687,6 @@ func addRecordResponseTiming(stack *middleware.Stack, options Options) error {
 		DisableClockSkewCorrection: options.DisableClockSkewCorrection,
 	}, middleware.After)
 }
-
-func addSpanRetryLoop(stack *middleware.Stack, options Options) error {
-	return stack.Finalize.Insert(&spanRetryLoop{options: options}, "Retry", middleware.Before)
-}
-
-type spanRetryLoop struct {
-	options Options
-}
-
-func (*spanRetryLoop) ID() string {
-	return "spanRetryLoop"
-}
-
-func (m *spanRetryLoop) HandleFinalize(
-	ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler,
-) (
-	middleware.FinalizeOutput, middleware.Metadata, error,
-) {
-	tracer := operationTracer(m.options.TracerProvider)
-	ctx, span := tracer.StartSpan(ctx, "RetryLoop")
-	defer span.End()
-
-	return next.HandleFinalize(ctx, in)
-}
 func addStreamingEventsPayload(stack *middleware.Stack) error {
 	return stack.Finalize.Add(&v4.StreamingEventsPayload{}, middleware.Before)
 }
@@ -761,9 +737,6 @@ func addRetry(stack *middleware.Stack, o Options, c *Client) error {
 	if err := stack.Finalize.Insert(attempt, "ResolveAuthScheme", middleware.Before); err != nil {
 		return err
 	}
-	if err := stack.Finalize.Insert(&retry.MetricsHeader{}, attempt.ID(), middleware.After); err != nil {
-		return err
-	}
 	return nil
 }

@@ -836,35 +809,21 @@ func addUserAgentRetryMode(stack *middleware.Stack, options Options) error {
 	return nil
 }

-type setCredentialSourceMiddleware struct {
-	ua      *awsmiddleware.RequestUserAgent
-	options Options
-}
-
-func (m setCredentialSourceMiddleware) ID() string { return "SetCredentialSourceMiddleware" }
-
-func (m setCredentialSourceMiddleware) HandleBuild(ctx context.Context, in middleware.BuildInput, next middleware.BuildHandler) (
-	out middleware.BuildOutput, metadata middleware.Metadata, err error,
-) {
-	asProviderSource, ok := m.options.Credentials.(aws.CredentialProviderSource)
-	if !ok {
-		return next.HandleBuild(ctx, in)
-	}
-	providerSources := asProviderSource.ProviderSources()
-	for _, source := range providerSources {
-		m.ua.AddCredentialsSource(source)
-	}
-	return next.HandleBuild(ctx, in)
-}
-
 func addCredentialSource(stack *middleware.Stack, options Options) error {
 	ua, err := getOrAddRequestUserAgent(stack)
 	if err != nil {
 		return err
 	}

-	mw := setCredentialSourceMiddleware{ua: ua, options: options}
-	return stack.Build.Insert(&mw, "UserAgent", middleware.Before)
+	asProviderSource, ok := options.Credentials.(aws.CredentialProviderSource)
+	if !ok {
+		return nil
+	}
+
+	for _, source := range asProviderSource.ProviderSources() {
+		ua.AddCredentialsSource(source)
+	}
+	return nil
 }

 func finalizeSTSRetryableErrors(o *Options) {
@@ -1024,9 +983,6 @@ func (c presignConverter) convertToPresignMiddleware(stack *middleware.Stack, op
 	if _, ok := stack.Finalize.Get((*retry.Attempt)(nil).ID()); ok {
 		stack.Finalize.Remove((*retry.Attempt)(nil).ID())
 	}
-	if _, ok := stack.Finalize.Get((*retry.MetricsHeader)(nil).ID()); ok {
-		stack.Finalize.Remove((*retry.MetricsHeader)(nil).ID())
-	}
 	stack.Deserialize.Clear()
 	stack.Build.Remove((*awsmiddleware.ClientRequestID)(nil).ID())
 	stack.Build.Remove("UserAgent")
@@ -421,9 +421,6 @@ func (c *Client) addOperationAssumeRoleMiddlewares(stack *middleware.Stack, opti
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -359,9 +359,6 @@ func (c *Client) addOperationAssumeRoleWithSAMLMiddlewares(stack *middleware.Sta
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -376,9 +376,6 @@ func (c *Client) addOperationAssumeRoleWithWebIdentityMiddlewares(stack *middlew
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -130,9 +130,6 @@ func (c *Client) addOperationAssumeRootMiddlewares(stack *middleware.Stack, opti
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -90,9 +90,6 @@ func (c *Client) addOperationDecodeAuthorizationMessageMiddlewares(stack *middle
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -81,9 +81,6 @@ func (c *Client) addOperationGetAccessKeyInfoMiddlewares(stack *middleware.Stack
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -72,9 +72,6 @@ func (c *Client) addOperationGetCallerIdentityMiddlewares(stack *middleware.Stac
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -70,9 +70,6 @@ func (c *Client) addOperationGetDelegatedAccessTokenMiddlewares(stack *middlewar
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -294,9 +294,6 @@ func (c *Client) addOperationGetFederationTokenMiddlewares(stack *middleware.Sta
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -143,9 +143,6 @@ func (c *Client) addOperationGetSessionTokenMiddlewares(stack *middleware.Stack,
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -93,9 +93,6 @@ func (c *Client) addOperationGetWebIdentityTokenMiddlewares(stack *middleware.St
 		return err
 	}

-	if err = addComputeContentLength(stack); err != nil {
-		return err
-	}
 	if err = addResolveEndpointMiddleware(stack, options); err != nil {
 		return err
 	}
@@ -3,4 +3,4 @@
 package sts

 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.45.8"
+const goModuleVersion = "1.50.0"
@@ -1,3 +1,33 @@
+# Release (2026-09-18)
+
+## General Highlights
+* **Dependency Update**: Updated to the latest SDK module versions
+
+## Module Highlights
+* `github.com/aws/smithy-go`: v1.28.2
+  * **Bug Fix**: Avoid allocating a slice in ValidateEndpointHost by indexing into the hostname instead of using strings.Split.
+  * **Bug Fix**: Fix event stream decode panic on unknown header value type.
+  * **Bug Fix**: Fix schema-serde CBOR decode panic on malformed string/blob length.
+  * **Bug Fix**: JoinPath keeps a trailing slash when the added path is a slash.
+
+# Release (2026-08-26)
+
+## General Highlights
+* **Dependency Update**: Updated to the latest SDK module versions
+
+## Module Highlights
+* `github.com/aws/smithy-go`: v1.28.1
+  * **Bug Fix**: Fix broken AddLogger middleware since its insert point was removed.
+
+# Release (2026-08-25.2)
+
+## General Highlights
+* **Dependency Update**: Updated to the latest SDK module versions
+
+## Module Highlights
+* `github.com/aws/smithy-go`: v1.28.0
+  * **Feature**: Set `Content-Length` inline when the request body is set via `SetStream`. The `ComputeContentLength` middleware is now deprecated.
+
 # Release (2026-08-25)

 ## General Highlights
@@ -26,7 +26,7 @@ smithy-publish-local:
 	cd codegen && ./gradlew publishToMavenLocal

 smithy-build:
-	cd codegen && ./gradlew build
+	cd codegen && ./gradlew build --stacktrace

 smithy-clean:
 	cd codegen && ./gradlew clean
@@ -1,73 +1,52 @@
 # Smithy Go

-[![Go Build Status](https://github.com/aws/smithy-go/actions/workflows/go.yml/badge.svg?branch=main)](https://github.com/aws/smithy-go/actions/workflows/go.yml)[![Codegen Build Status](https://github.com/aws/smithy-go/actions/workflows/codegen.yml/badge.svg?branch=main)](https://github.com/aws/smithy-go/actions/workflows/codegen.yml)
+[![Go Build Status](https://github.com/aws/smithy-go/actions/workflows/go.yml/badge.svg?branch=main)](https://github.com/aws/smithy-go/actions/workflows/go.yml)
+[![Codegen Build Status](https://github.com/aws/smithy-go/actions/workflows/codegen.yml/badge.svg?branch=main)](https://github.com/aws/smithy-go/actions/workflows/codegen.yml)
+[![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)

-[Smithy](https://smithy.io/) code generators for Go and the accompanying smithy-go runtime.
+[Smithy](https://smithy.io/) code generators for [Go](https://go.dev/), and
+the runtime package the generated code depends on.

-The smithy-go runtime requires a minimum version of Go 1.24.
+> [!WARNING]
+> All interfaces in this repository are subject to change. The client code
+> generator in particular powers
+> [aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2), but arbitrary client
+> generation is in an early stage of development:
+> * Generated clients are missing certain features that were originally
+>   implemented SDK-side (e.g. retries)
+> * There may be bugs
+> * The public APIs of generated clients may be unstable
+>
+> If you are interested in using the client code generators, we encourage you
+> to experiment and share any feedback with us in an issue.

-**WARNING: All interfaces are subject to change.**
+---

-## :warning: Client codegen is unstable
+This repository contains two major components:

-The client code generator in this repository powers the aws-sdk-go-v2.
-Arbitrary client generation, while possible, is in an early stage of
-development:
+1. **Codegen** ([`codegen/`](codegen)): A Java/Gradle-based Smithy build
+   plugin that generates Go client, server, and shape code from Smithy
+   models.
+2. **Runtime** (this module, `github.com/aws/smithy-go`): The Go packages
+   that code generated by the plugins above depends on.

-* Generated clients are missing certain features that were originally
-  implemented SDK-side (e.g. retries)
-* There may be bugs
-* The public APIs of generated clients may be unstable
+> [!NOTE]
+> This repository does not contain any generated clients, such as for S3 or
+> other AWS services. Rather, these are the tools that facilitate generating
+> those clients (and non-AWS Smithy clients) from a Smithy model.

-If you are interested in using the client code generators, we encourage you to
-experiment and share any feedback with us in an issue.
+## Getting started

-## Plugins
+If this is your first time using Smithy, follow the
+[Smithy Quickstart guide](https://smithy.io/2.0/quickstart.html) to learn the
+basics and create a simple Smithy model.

-This repository implements the following Smithy build plugins:
+The smithy-go runtime requires a minimum version of **Go 1.24**.

-| ID | GAV prefix | Description |
-|----|------------|-------------|
-| `go-codegen`        | `software.amazon.smithy.go:smithy-go-codegen` | Implements Go client code generation for Smithy models. |
-| `go-server-codegen` | `software.amazon.smithy.go:smithy-go-codegen` | Implements Go server code generation for Smithy models. |
-| `go-shape-codegen` | `software.amazon.smithy.go:smithy-go-codegen` | Implements Go shape code generation (types only) for Smithy models. |
+### Codegen

-## `go-codegen`
-
-### Configuration
-
-[`GoSettings`](codegen/smithy-go-codegen/src/main/java/software/amazon/smithy/go/codegen/GoSettings.java)
-contains all of the settings enabled from `smithy-build.json` and helper
-methods and types. The up-to-date list of top-level properties enabled for
-`go-client-codegen` can be found in `GoSettings::from()`.
-
-| Setting         | Type    | Required | Description                                                                                                                 |
-|-----------------|---------|----------|-----------------------------------------------------------------------------------------------------------------------------|
-| `service`       | string  | yes      | The Shape ID of the service for which to generate the client.                                                               |
-| `module`        | string  | yes      | Name of the module in `generated.json` (and `go.mod` if `generateGoMod` is enabled) and `doc.go`.                           |
-| `generateGoMod` | boolean |          | Whether to generate a default `go.mod` file. The default value is `false`.                                                  |
-| `goDirective`   | string  |          | [Go directive](https://go.dev/ref/mod#go-mod-file-go) of the module. The default value is the minimum supported Go version. |
-
-### Supported protocols
-
-The protocol a client uses is configured by the `Protocol` field on a client's
-`Options`. The SDK will configure a default based on the protocol traits
-applied to the modeled service.
-
-| Protocol | Notes |
-|----------|-------|
-| [`smithy.protocols#rpcv2Cbor`](https://smithy.io/2.0/additional-specs/protocols/smithy-rpc-v2.html) | |
-| [`aws.protocols#restJson1`](https://smithy.io/2.0/aws/protocols/aws-restjson1-protocol.html) | |
-| [`aws.protocols#restXml`](https://smithy.io/2.0/aws/protocols/aws-restxml-protocol.html) | |
-| [`aws.protocols#awsJson1_0`](https://smithy.io/2.0/aws/protocols/aws-json-1_0-protocol.html) | |
-| [`aws.protocols#awsJson1_1`](https://smithy.io/2.0/aws/protocols/aws-json-1_1-protocol.html) | |
-| [`aws.protocols#awsQuery`](https://smithy.io/2.0/aws/protocols/aws-query-protocol.html) | |
-| [`aws.protocols#ec2Query`](https://smithy.io/2.0/aws/protocols/aws-ec2-query-protocol.html) | |
-
-### Example
-
-This example applies the `go-codegen` build plugin to the Smithy quickstart
-example created from `smithy init`:
+To generate a Go client from a Smithy model, apply the `go-codegen` plugin in
+your `smithy-build.json`:

 ```json
 {
@@ -91,15 +70,136 @@ example created from `smithy init`:
 }
 ```

-## `go-server-codegen`
+This repository implements the following Smithy build plugins:

-This plugin is a work-in-progress and is currently undocumented.
+| ID | GAV prefix | Description |
+|----|------------|-------------|
+| `go-codegen`        | `software.amazon.smithy.go:smithy-go-codegen` | Go client code generation for Smithy models. |
+| `go-server-codegen` | `software.amazon.smithy.go:smithy-go-codegen` | Go server code generation for Smithy models (work-in-progress, undocumented). |
+| `go-shape-codegen`  | `software.amazon.smithy.go:smithy-go-codegen` | Go shape code generation (types only) for Smithy models (work-in-progress, undocumented). |

-## `go-shape-codegen`
+#### `go-codegen` settings

-This plugin is a work-in-progress and is currently undocumented.
+[`GoSettings`](codegen/smithy-go-codegen/src/main/java/software/amazon/smithy/go/codegen/GoSettings.java)
+contains all of the settings enabled from `smithy-build.json`. The up-to-date
+list of top-level properties enabled for `go-codegen` can be found in
+`GoSettings::from()`.
+
+| Setting         | Type    | Required | Description                                                                                                                 |
+|-----------------|---------|----------|-------------------------------------------------------------------------------------------------------------------------------|
+| `service`       | string  | yes      | The Shape ID of the service for which to generate the client.                                                                 |
+| `module`        | string  | yes      | Name of the module in `generated.json` (and `go.mod` if `generateGoMod` is enabled) and `doc.go`.                             |
+| `generateGoMod` | boolean |          | Whether to generate a default `go.mod` file. The default value is `false`.                                                    |
+| `goDirective`   | string  |          | [Go directive](https://go.dev/ref/mod#go-mod-file-go) of the module. The default value is the minimum supported Go version.  |
+
+#### Supported protocols
+
+The protocol a generated client uses is configured by the `Protocol` field on
+the client's `Options`. The SDK configures a default based on the protocol
+traits applied to the modeled service.
+
+Each protocol is implemented as its own package under
+[`transport/http/protocol`](transport/http/protocol). Serialization for these
+protocols is handled by internal codecs under `protocol/internal` (e.g.
+`protocol/internal/json`, `protocol/internal/cbor`,
+`protocol/internal/xml`); these largely supersede the top-level
+[`encoding/`](encoding) packages of the same name; see
+[Encoding](#encoding) below.
+
+| Protocol | Package | Notes |
+|----------|---------|-------|
+| [`smithy.protocols#rpcv2Cbor`](https://smithy.io/2.0/additional-specs/protocols/smithy-rpc-v2.html) | [`protocol/rpcv2`](transport/http/protocol/rpcv2) | |
+| [`aws.protocols#restJson1`](https://smithy.io/2.0/aws/protocols/aws-restjson1-protocol.html) | [`protocol/restjson1`](transport/http/protocol/restjson1) | |
+| [`aws.protocols#restXml`](https://smithy.io/2.0/aws/protocols/aws-restxml-protocol.html) | [`protocol/restxml`](transport/http/protocol/restxml) | |
+| [`aws.protocols#awsJson1_0`](https://smithy.io/2.0/aws/protocols/aws-json-1_0-protocol.html) | [`protocol/awsjson`](transport/http/protocol/awsjson) | `awsjson.New10` |
+| [`aws.protocols#awsJson1_1`](https://smithy.io/2.0/aws/protocols/aws-json-1_1-protocol.html) | [`protocol/awsjson`](transport/http/protocol/awsjson) | `awsjson.New11` |
+| [`aws.protocols#awsQuery`](https://smithy.io/2.0/aws/protocols/aws-query-protocol.html) | [`protocol/awsquery`](transport/http/protocol/awsquery) | |
+| [`aws.protocols#ec2Query`](https://smithy.io/2.0/aws/protocols/aws-ec2-query-protocol.html) | [`protocol/ec2query`](transport/http/protocol/ec2query) | |
+
+These packages are client-only; smithy-go does not currently implement
+server-side protocol support.
+
+Building and testing the codegen plugins is done via Gradle from the
+`codegen/` directory:
+
+```bash
+# Build and test codegen
+cd codegen && ./gradlew build
+
+# Publish to local Maven for downstream use
+cd codegen && ./gradlew publishToMavenLocal
+```
+
+See [`codegen/README.md`](codegen/README.md) for local setup instructions.
+
+## Runtime packages
+
+All generated clients depend on this module (`github.com/aws/smithy-go`) at
+runtime. It also includes a few standalone submodules published separately.
+
+### Core
+
+- [`middleware`](middleware): The middleware stack that drives the operation
+  pipeline.
+- [`transport/http`](transport/http): HTTP request/response types and
+  middleware.
+- [`auth`](auth): Auth identity and scheme interfaces.
+  - [`auth/bearer`](auth/bearer): Bearer token auth.
+- [`endpoints`](endpoints): Endpoint resolution types.
+- [`context`](context): Context helpers.
+- [`logging`](logging): Logging interfaces.
+- [`tracing`](tracing): Tracing interfaces.
+- [`metrics`](metrics): Metrics interfaces.
+
+### Encoding
+
+Wire format encoders/decoders under [`encoding/`](encoding).
+
+> [!NOTE]
+> Most of these packages are effectively legacy. The protocol
+> implementations under [`transport/http/protocol`](transport/http/protocol)
+> (used by current client codegen) have their own internal codecs under
+> `protocol/internal/*` and generally do not build on these packages.
+> The `encoding/json`, `encoding/xml`, and `encoding/cbor` packages otherwise
+> remain in use by [`document/json`](document/json)/[`document/cbor`](document/cbor)
+> and [`eventstream`](eventstream), and by existing generated SDK code that
+> predates the newer protocol implementations.
+
+- [`encoding/json`](encoding/json): JSON encoding/decoding.
+- [`encoding/xml`](encoding/xml): XML encoding/decoding.
+- [`encoding/cbor`](encoding/cbor): CBOR encoding/decoding (used by
+  `rpcv2Cbor`).
+- [`encoding/httpbinding`](encoding/httpbinding): HTTP binding serde helpers.
+
+### Document
+
+- [`document`](document): Smithy document type abstraction.
+  - [`document/json`](document/json): JSON document codec.
+
+### Utilities
+
+- [`container`](container): Generic container types.
+- [`io`](io): I/O helpers.
+- [`ptr`](ptr): Pointer-to/from-value helpers.
+- [`time`](time): Smithy timestamp format helpers.
+- [`rand`](rand): UUID/randomness helpers.
+- [`testing`](testing): Test assertion helpers for generated protocol tests.
+
+### Standalone modules
+
+These are published as separate Go modules, each with its own `go.mod`.
+
+- [`aws-http-auth`](aws-http-auth): AWS SigV4/SigV4A HTTP signing.
+- [`tracing/smithyoteltracing`](tracing/smithyoteltracing): OpenTelemetry
+  tracing adapter.
+- [`metrics/smithyotelmetrics`](metrics/smithyotelmetrics): OpenTelemetry
+  metrics adapter.
+
+## Development
+
+See [CONTRIBUTING](CONTRIBUTING.md) for more information on contributing to
+this project, including the changelog process for runtime changes.

 ## License

 This project is licensed under the Apache-2.0 License.
-
@@ -139,6 +139,6 @@ func valueFromType(typ valueType, val any) (Value, error) {
 		copy(tv[:], v)
 		return tv, err
 	default:
-		panic(fmt.Sprintf("unknown type, %s, %T", typ.String(), val))
+		return nil, fmt.Errorf("unable to decode unknown type, %s, %T", typ.String(), val)
 	}
 }
@@ -151,7 +151,7 @@ func decodeHeaderValue(r io.Reader) (Value, error) {
 		err = tv.decode(r)
 		v = tv
 	default:
-		panic(fmt.Sprintf("unknown value type %d", raw.Type))
+		return nil, fmt.Errorf("unable to decode header of unknown value type %d", raw.Type)
 	}

 	// Error could be EOF, let caller deal with it
@@ -3,4 +3,4 @@
 package smithy

 // goModuleVersion is the tagged release for this module
-const goModuleVersion = "1.27.10"
+const goModuleVersion = "1.28.2"
@@ -29,17 +29,23 @@ func ValidateEndpointHost(host string) error {
 		hostname = host
 	}

-	labels := strings.Split(hostname, ".")
-	for i, label := range labels {
-		if i == len(labels)-1 && len(label) == 0 {
-			// Allow trailing dot for FQDN hosts.
-			continue
+	for start := 0; ; {
+		idx := strings.IndexByte(hostname[start:], '.')
+		if idx < 0 {
+			// Last label. Allow it to be empty to permit a trailing dot for
+			// FQDN hosts.
+			if label := hostname[start:]; len(label) != 0 && !ValidHostLabel(label) {
+				errors.WriteString("\nendpoint host domain labels must match \"[a-zA-Z0-9-]{1,63}\", but found: ")
+				errors.WriteString(label)
+			}
+			break
 		}

-		if !ValidHostLabel(label) {
+		if label := hostname[start : start+idx]; !ValidHostLabel(label) {
 			errors.WriteString("\nendpoint host domain labels must match \"[a-zA-Z0-9-]{1,63}\", but found: ")
 			errors.WriteString(label)
 		}
+		start += idx + 1
 	}

 	if len(hostname) == 0 && len(port) != 0 {
@@ -14,6 +14,9 @@ type ComputeContentLength struct {

 // AddComputeContentLengthMiddleware adds ComputeContentLength to the middleware
 // stack's Build step.
+//
+// Deprecated: Content-Length is now set when the request body is set via
+// Request.SetStream, so this middleware is no longer used.
 func AddComputeContentLengthMiddleware(stack *middleware.Stack) error {
 	return stack.Build.Add(&ComputeContentLength{}, middleware.After)
 }
@@ -118,6 +118,9 @@ func (r *Request) IsStreamSeekable() bool {
 // SetStream returns a clone of the request with the stream set to the provided
 // reader. May return an error if the provided reader is seekable but returns
 // an error.
+//
+// ContentLength is set to the stream's length when it can be determined, and
+// left unchanged otherwise.
 func (r *Request) SetStream(reader io.Reader) (rc *Request, err error) {
 	rc = r.Clone()

@@ -151,6 +154,12 @@ func (r *Request) SetStream(reader io.Reader) (rc *Request, err error) {
 	rc.isStreamSeekable = isStreamSeekable
 	rc.streamStartPos = streamStartPos

+	if n, ok, err := rc.StreamLength(); err != nil {
+		return rc, err
+	} else if ok {
+		rc.ContentLength = n
+	}
+
 	return rc, err
 }

@@ -12,6 +12,9 @@ func JoinPath(a, b string) string {
 		a = "/" + a
 	}

+	// Record b's trailing slash before the strip below can erase it (a bare
+	// "/" becomes "").
+	keepTrailing := len(b) > 0 && b[len(b)-1] == '/'
 	if len(b) != 0 && b[0] == '/' {
 		b = b[1:]
 	}
@@ -20,6 +23,10 @@ func JoinPath(a, b string) string {
 		a = a + "/"
 	}

+	if keepTrailing && len(b) == 0 && a[len(a)-1] != '/' {
+		a = a + "/"
+	}
+
 	return a + b
 }

@@ -30,7 +30,7 @@ func (m *Logger) HandleInitialize(ctx context.Context, in middleware.InitializeI
 	return next.HandleInitialize(ctx, in)
 }

-// AddLogger is a helper util to add waiter logger after `SetLogger` middleware in
+// AddLogger is a helper util to add a waiter logger to the initialize stack.
 func (m Logger) AddLogger(stack *middleware.Stack) error {
-	return stack.Initialize.Insert(&m, "SetLogger", middleware.After)
+	return stack.Initialize.Add(&m, middleware.After)
 }
@@ -142,7 +142,7 @@ func (c *Client) send(sid uint32, mt messageType, flags uint8, b []byte) error {
 }

 // Call makes a unary request and returns with response
-func (c *Client) Call(ctx context.Context, service, method string, req, resp interface{}) error {
+func (c *Client) Call(ctx context.Context, service, method string, req, resp any) error {
 	payload, err := c.codec.Marshal(req)
 	if err != nil {
 		return err
@@ -194,8 +194,8 @@ type StreamDesc struct {
 // ClientStream is used to send or recv messages on the underlying stream
 type ClientStream interface {
 	CloseSend() error
-	SendMsg(m interface{}) error
-	RecvMsg(m interface{}) error
+	SendMsg(m any) error
+	RecvMsg(m any) error
 }

 type clientStream struct {
@@ -222,7 +222,7 @@ func (cs *clientStream) CloseSend() error {
 	return nil
 }

-func (cs *clientStream) SendMsg(m interface{}) error {
+func (cs *clientStream) SendMsg(m any) error {
 	if !cs.desc.StreamingClient {
 		return fmt.Errorf("%w: cannot send data from non-streaming client", ErrProtocol)
 	}
@@ -249,7 +249,7 @@ func (cs *clientStream) SendMsg(m interface{}) error {
 	return nil
 }

-func (cs *clientStream) RecvMsg(m interface{}) error {
+func (cs *clientStream) RecvMsg(m any) error {
 	if cs.remoteClosed {
 		return io.EOF
 	}
@@ -490,7 +490,7 @@ func filterCloseErr(err error) error {
 // NewStream creates a new stream with the given stream descriptor to the
 // specified service and method. If not a streaming client, the request object
 // may be provided.
-func (c *Client) NewStream(ctx context.Context, desc *StreamDesc, service, method string, req interface{}) (ClientStream, error) {
+func (c *Client) NewStream(ctx context.Context, desc *StreamDesc, service, method string, req any) (ClientStream, error) {
 	var payload []byte
 	if req != nil {
 		var err error
@@ -24,7 +24,7 @@ import (

 type codec struct{}

-func (c codec) Marshal(msg interface{}) ([]byte, error) {
+func (c codec) Marshal(msg any) ([]byte, error) {
 	switch v := msg.(type) {
 	case proto.Message:
 		return proto.Marshal(v)
@@ -33,7 +33,7 @@ func (c codec) Marshal(msg interface{}) ([]byte, error) {
 	}
 }

-func (c codec) Unmarshal(p []byte, msg interface{}) error {
+func (c codec) Unmarshal(p []byte, msg any) error {
 	switch v := msg.(type) {
 	case proto.Message:
 		return proto.Unmarshal(p, v)
@@ -67,7 +67,7 @@ func WithChainUnaryServerInterceptor(interceptors ...UnaryServerInterceptor) Ser
 			ctx context.Context,
 			unmarshal Unmarshaler,
 			info *UnaryServerInfo,
-			method Method) (interface{}, error) {
+			method Method) (any, error) {
 			return interceptors[0](ctx, unmarshal, info,
 				chainUnaryServerInterceptors(info, method, interceptors[1:]))
 		}
@@ -79,7 +79,7 @@ func chainUnaryServerInterceptors(info *UnaryServerInfo, method Method, intercep
 	if len(interceptors) == 0 {
 		return method
 	}
-	return func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+	return func(ctx context.Context, unmarshal func(any) error) (any, error) {
 		return interceptors[0](ctx, unmarshal, info,
 			chainUnaryServerInterceptors(info, method, interceptors[1:]))
 	}
@@ -36,15 +36,15 @@ type Handshaker interface {
 	// While we currently only have implementations on the server-side, this
 	// interface should be sufficient to implement similar handshakes on the
 	// client-side.
-	Handshake(ctx context.Context, conn net.Conn) (net.Conn, interface{}, error)
+	Handshake(ctx context.Context, conn net.Conn) (net.Conn, any, error)
 }

-type handshakerFunc func(ctx context.Context, conn net.Conn) (net.Conn, interface{}, error)
+type handshakerFunc func(ctx context.Context, conn net.Conn) (net.Conn, any, error)

-func (fn handshakerFunc) Handshake(ctx context.Context, conn net.Conn) (net.Conn, interface{}, error) {
+func (fn handshakerFunc) Handshake(ctx context.Context, conn net.Conn) (net.Conn, any, error) {
 	return fn(ctx, conn)
 }

-func noopHandshake(_ context.Context, conn net.Conn) (net.Conn, interface{}, error) {
+func noopHandshake(_ context.Context, conn net.Conn) (net.Conn, any, error) {
 	return conn, nil, nil
 }
@@ -37,18 +37,18 @@ type StreamServerInfo struct {

 // Unmarshaler contains the server request data and allows it to be unmarshaled
 // into a concrete type
-type Unmarshaler func(interface{}) error
+type Unmarshaler func(any) error

 // Invoker invokes the client's request and response from the ttrpc server
 type Invoker func(context.Context, *Request, *Response) error

 // UnaryServerInterceptor specifies the interceptor function for server request/response
-type UnaryServerInterceptor func(context.Context, Unmarshaler, *UnaryServerInfo, Method) (interface{}, error)
+type UnaryServerInterceptor func(context.Context, Unmarshaler, *UnaryServerInfo, Method) (any, error)

 // UnaryClientInterceptor specifies the interceptor function for client request/response
 type UnaryClientInterceptor func(context.Context, *Request, *Response, *UnaryClientInfo, Invoker) error

-func defaultServerInterceptor(ctx context.Context, unmarshal Unmarshaler, _ *UnaryServerInfo, method Method) (interface{}, error) {
+func defaultServerInterceptor(ctx context.Context, unmarshal Unmarshaler, _ *UnaryServerInfo, method Method) (any, error) {
 	return method(ctx, unmarshal)
 }

@@ -56,9 +56,9 @@ func defaultClientInterceptor(ctx context.Context, req *Request, resp *Response,
 	return invoker(ctx, req, resp)
 }

-type StreamServerInterceptor func(context.Context, StreamServer, *StreamServerInfo, StreamHandler) (interface{}, error)
+type StreamServerInterceptor func(context.Context, StreamServer, *StreamServerInfo, StreamHandler) (any, error)

-func defaultStreamServerInterceptor(ctx context.Context, ss StreamServer, _ *StreamServerInfo, stream StreamHandler) (interface{}, error) {
+func defaultStreamServerInterceptor(ctx context.Context, ss StreamServer, _ *StreamServerInfo, stream StreamHandler) (any, error) {
 	return stream(ctx, ss)
 }

@@ -283,7 +283,7 @@ func (cs connState) String() string {
 	}
 }

-func (s *Server) newConn(conn net.Conn, handshake interface{}) (*serverConn, error) {
+func (s *Server) newConn(conn net.Conn, handshake any) (*serverConn, error) {
 	c := &serverConn{
 		server:    s,
 		conn:      conn,
@@ -301,7 +301,7 @@ func (s *Server) newConn(conn net.Conn, handshake interface{}) (*serverConn, err
 type serverConn struct {
 	server    *Server
 	conn      net.Conn
-	handshake interface{} // data from handshake, not used for now
+	handshake any // data from handshake, not used for now
 	state     atomic.Value

 	shutdownOnce sync.Once
@@ -417,7 +417,7 @@ func (c *serverConn) run(sctx context.Context) {
 				}
 				sh := i.(*streamHandler)
 				if mh.Flags&flagNoData != flagNoData {
-					unmarshal := func(obj interface{}) error {
+					unmarshal := func(obj any) error {
 						err := protoUnmarshal(p, obj)
 						ch.putmbuf(p)
 						return err
@@ -31,9 +31,9 @@ import (
 	"google.golang.org/protobuf/proto"
 )

-type Method func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error)
+type Method func(ctx context.Context, unmarshal func(any) error) (any, error)

-type StreamHandler func(context.Context, StreamServer) (interface{}, error)
+type StreamHandler func(context.Context, StreamServer) (any, error)

 type Stream struct {
 	Handler         StreamHandler
@@ -69,7 +69,7 @@ func (s *serviceSet) register(name string, desc *ServiceDesc) {
 }

 func (s *serviceSet) unaryCall(ctx context.Context, method Method, info *UnaryServerInfo, data []byte) (p []byte, st *status.Status) {
-	unmarshal := func(obj interface{}) error {
+	unmarshal := func(obj any) error {
 		return protoUnmarshal(data, obj)
 	}

@@ -150,7 +150,7 @@ func (s *serviceSet) handle(ctx context.Context, req *Request, respond func(*sta
 		// don't get invoked here, which causes hang on client side.
 		// See https://github.com/containerd/ttrpc/issues/126
 		if req.Payload != nil || !info.StreamingClient {
-			unmarshal := func(obj interface{}) error {
+			unmarshal := func(obj any) error {
 				return protoUnmarshal(req.Payload, obj)
 			}
 			if err := sh.data(unmarshal); err != nil {
@@ -209,7 +209,7 @@ func (s *streamHandler) data(unmarshal Unmarshaler) error {
 	}
 }

-func (s *streamHandler) SendMsg(m interface{}) error {
+func (s *streamHandler) SendMsg(m any) error {
 	if s.localClosed {
 		return ErrStreamClosed
 	}
@@ -220,7 +220,7 @@ func (s *streamHandler) SendMsg(m interface{}) error {
 	return s.respond(nil, p, true, false)
 }

-func (s *streamHandler) RecvMsg(m interface{}) error {
+func (s *streamHandler) RecvMsg(m any) error {
 	select {
 	case unmarshal, ok := <-s.recv:
 		if !ok {
@@ -233,7 +233,7 @@ func (s *streamHandler) RecvMsg(m interface{}) error {
 	}
 }

-func protoUnmarshal(p []byte, obj interface{}) error {
+func protoUnmarshal(p []byte, obj any) error {
 	switch v := obj.(type) {
 	case proto.Message:
 		if err := proto.Unmarshal(p, v); err != nil {
@@ -245,7 +245,7 @@ func protoUnmarshal(p []byte, obj interface{}) error {
 	return nil
 }

-func protoMarshal(obj interface{}) ([]byte, error) {
+func protoMarshal(obj any) ([]byte, error) {
 	if obj == nil {
 		return nil, nil
 	}
@@ -296,6 +296,6 @@ func fullPath(service, method string) string {
 	return "/" + path.Join(service, method)
 }

-func isNil(resp interface{}) bool {
+func isNil(resp any) bool {
 	return (*[2]uintptr)(unsafe.Pointer(&resp))[1] == 0
 }
@@ -17,6 +17,6 @@
 package ttrpc

 type StreamServer interface {
-	SendMsg(m interface{}) error
-	RecvMsg(m interface{}) error
+	SendMsg(m any) error
+	RecvMsg(m any) error
 }
@@ -72,13 +72,15 @@ func ResponseFormat(h http.Header) Format {

 // NewDecoder returns a new decoder based on the given input format. Metric
 // names are validated based on the provided Format -- if the format requires
-// escaping, raditional Prometheues validity checking is used. Otherwise, names
+// escaping, traditional Prometheus validity checking is used. Otherwise, names
 // are checked for UTF-8 validity. Supported formats include delimited protobuf
-// and Prometheus text format.  For historical reasons, this decoder fallbacks
-// to classic text decoding for any other format. This decoder does not fully
-// support OpenMetrics although it may often succeed due to the similarities
-// between the formats. This decoder may not support the latest features of
-// Prometheus text format and is not intended for high-performance applications.
+// and Prometheus text format. For historical reasons, this decoder falls back
+// to classic text decoding for other legacy formats, but returns an error for
+// unsupported formats such as OpenMetrics 2.0. This decoder does not fully
+// support OpenMetrics although it may often succeed for OpenMetrics 1.0 due to
+// the similarities between the formats. This decoder may not support the latest
+// features of Prometheus text format and is not intended for high-performance
+// applications.
 // See: https://github.com/prometheus/common/issues/812
 func NewDecoder(r io.Reader, format Format) Decoder {
 	scheme := model.LegacyValidation
@@ -90,6 +92,11 @@ func NewDecoder(r io.Reader, format Format) Decoder {
 		return &protoDecoder{r: bufio.NewReader(r), s: scheme}
 	case TypeProtoText, TypeProtoCompact:
 		return &errDecoder{err: fmt.Errorf("format %s not supported for decoding", format)}
+	case TypeOpenMetrics:
+		_, params, err := mime.ParseMediaType(string(format))
+		if err == nil && params["version"] == OpenMetricsVersion_2_0_0 {
+			return &errDecoder{err: fmt.Errorf("format %s not supported for decoding", format)}
+		}
 	}
 	return &textDecoder{r: r, s: scheme}
 }
@@ -16,6 +16,7 @@ package expfmt
 import (
 	"fmt"
 	"io"
+	"mime"
 	"net/http"

 	"github.com/munnerz/goautoneg"
@@ -26,6 +27,24 @@ import (
 	"github.com/prometheus/common/model"
 )

+var formatToAccept = map[Format]goautoneg.Accept{}
+
+func init() {
+	for _, f := range []Format{
+		FmtText,
+		FmtProtoDelim,
+		FmtProtoText,
+		FmtProtoCompact,
+		FmtOpenMetrics_1_0_0,
+		fmtOpenMetrics_2_0_0,
+		FmtOpenMetrics_0_0_1,
+	} {
+		if parsed := goautoneg.ParseAccept(string(f)); len(parsed) > 0 {
+			formatToAccept[f] = parsed[0]
+		}
+	}
+}
+
 // Encoder types encode metric families into an underlying wire protocol.
 type Encoder interface {
 	Encode(*dto.MetricFamily) error
@@ -57,11 +76,30 @@ func (ec encoderCloser) Close() error {

 // Negotiate returns the Content-Type based on the given Accept header. If no
 // appropriate accepted type is found, FmtText is returned (which is the
-// Prometheus text format). This function will never negotiate FmtOpenMetrics,
-// as the support is still experimental. To include the option to negotiate
-// FmtOpenMetrics, use NegotiateIncludingOpenMetrics.
+// Prometheus text format).
+//
+// Deprecated: Use NegotiateAccept(h, FmtProtoDelim, FmtProtoText, FmtProtoCompact, FmtText)
+// or specify only the formats supported by your server.
 func Negotiate(h http.Header) Format {
-	escapingScheme := Format(fmt.Sprintf("; escaping=%s", Format(model.NameEscapingScheme.String())))
+	return NegotiateAccept(h, FmtProtoDelim, FmtProtoText, FmtProtoCompact, FmtText)
+}
+
+// NegotiateIncludingOpenMetrics works like Negotiate but includes
+// FmtOpenMetrics as an option for the result.
+//
+// Deprecated: Use NegotiateAccept(h, FmtOpenMetrics_1_0_0, FmtOpenMetrics_0_0_1, FmtProtoDelim, FmtProtoText, FmtProtoCompact, FmtText)
+// or specify only the formats supported by your server.
+func NegotiateIncludingOpenMetrics(h http.Header) Format {
+	return NegotiateAccept(h, FmtOpenMetrics_1_0_0, FmtOpenMetrics_0_0_1, FmtProtoDelim, FmtProtoText, FmtProtoCompact, FmtText)
+}
+
+// NegotiateAccept returns the Content-Type based on the given Accept header
+// and the list of accepted Formats provided by the caller, in order of preference.
+// If no accepted format matches the Accept header, it falls back to the text
+// format if present in the accepted list, or the first accepted format (or FmtText
+// if accepted is empty).
+func NegotiateAccept(h http.Header, accepted ...Format) Format {
+	escapingScheme := Format("; escaping=" + model.NameEscapingScheme.String())
 	for _, ac := range goautoneg.ParseAccept(h.Get(hdrAccept)) {
 		if escapeParam := ac.Params[model.EscapingKey]; escapeParam != "" {
 			switch Format(escapeParam) {
@@ -71,63 +109,66 @@ func Negotiate(h http.Header) Format {
 				// If the escaping parameter is unknown, ignore it.
 			}
 		}
-		ver := ac.Params["version"]
-		if ac.Type+"/"+ac.SubType == ProtoType && ac.Params["proto"] == ProtoProtocol {
-			switch ac.Params["encoding"] {
-			case "delimited":
-				return FmtProtoDelim + escapingScheme
-			case "text":
-				return FmtProtoText + escapingScheme
-			case "compact-text":
-				return FmtProtoCompact + escapingScheme
+
+		for _, f := range accepted {
+			if matchFormat(ac, f) {
+				return f + escapingScheme
 			}
 		}
-		if ac.Type == "text" && ac.SubType == "plain" && (ver == TextVersion || ver == "") {
-			return FmtText + escapingScheme
+	}
+	for _, f := range accepted {
+		if f.FormatType() == TypeTextPlain {
+			return f + escapingScheme
 		}
 	}
+	if len(accepted) > 0 {
+		return accepted[0] + escapingScheme
+	}
 	return FmtText + escapingScheme
 }

-// NegotiateIncludingOpenMetrics works like Negotiate but includes
-// FmtOpenMetrics as an option for the result. Note that this function is
-// temporary and will disappear once FmtOpenMetrics is fully supported and as
-// such may be negotiated by the normal Negotiate function.
-func NegotiateIncludingOpenMetrics(h http.Header) Format {
-	escapingScheme := Format(fmt.Sprintf("; escaping=%s", Format(model.NameEscapingScheme.String())))
-	for _, ac := range goautoneg.ParseAccept(h.Get(hdrAccept)) {
-		if escapeParam := ac.Params[model.EscapingKey]; escapeParam != "" {
-			switch Format(escapeParam) {
-			case model.AllowUTF8, model.EscapeUnderscores, model.EscapeDots, model.EscapeValues:
-				escapingScheme = Format("; escaping=" + escapeParam)
-			default:
-				// If the escaping parameter is unknown, ignore it.
-			}
+// matchFormat checks if a parsed accept clause matches a given Format.
+func matchFormat(ac goautoneg.Accept, f Format) bool {
+	target, ok := formatToAccept[f]
+	if !ok {
+		parsed := goautoneg.ParseAccept(string(f))
+		if len(parsed) == 0 {
+			return false
 		}
-		ver := ac.Params["version"]
-		if ac.Type+"/"+ac.SubType == ProtoType && ac.Params["proto"] == ProtoProtocol {
-			switch ac.Params["encoding"] {
-			case "delimited":
-				return FmtProtoDelim + escapingScheme
-			case "text":
-				return FmtProtoText + escapingScheme
-			case "compact-text":
-				return FmtProtoCompact + escapingScheme
-			}
+		target = parsed[0]
+	}
+
+	if ac.Type != "*" && ac.Type != target.Type {
+		return false
+	}
+	if ac.SubType != "*" && ac.SubType != target.SubType {
+		return false
+	}
+
+	// Default OpenMetrics version to OpenMetricsVersion_0_0_1.
+	acVersion := ac.Params["version"]
+	if acVersion == "" && ac.Type+"/"+ac.SubType == OpenMetricsType {
+		acVersion = OpenMetricsVersion_0_0_1
+	}
+	if acVersion == "" && ac.Type == "text" && ac.SubType == "plain" {
+		acVersion = TextVersion
+	}
+
+	// General param matching.
+	for k, v := range target.Params {
+		if k == "charset" {
+			continue
 		}
-		if ac.Type == "text" && ac.SubType == "plain" && (ver == TextVersion || ver == "") {
-			return FmtText + escapingScheme
+		acVal := ac.Params[k]
+		if k == "version" {
+			acVal = acVersion
 		}
-		if ac.Type+"/"+ac.SubType == OpenMetricsType && (ver == OpenMetricsVersion_0_0_1 || ver == OpenMetricsVersion_1_0_0 || ver == "") {
-			switch ver {
-			case OpenMetricsVersion_1_0_0:
-				return FmtOpenMetrics_1_0_0 + escapingScheme
-			default:
-				return FmtOpenMetrics_0_0_1 + escapingScheme
-			}
+		if acVal != v {
+			return false
 		}
 	}
-	return FmtText + escapingScheme
+
+	return true
 }

 // NewEncoder returns a new encoder based on content type negotiation. All
@@ -181,6 +222,19 @@ func NewEncoder(w io.Writer, format Format, options ...EncoderOption) Encoder {
 			close: func() error { return nil },
 		}
 	case TypeOpenMetrics:
+		_, params, err := mime.ParseMediaType(string(format))
+		if err == nil && params["version"] == OpenMetricsVersion_2_0_0 {
+			return encoderCloser{
+				encode: func(v *dto.MetricFamily) error {
+					_, err := MetricFamilyToOpenMetrics20(w, model.EscapeMetricFamily(v, escapingScheme), options...)
+					return err
+				},
+				close: func() error {
+					_, err := FinalizeOpenMetrics(w)
+					return err
+				},
+			}
+		}
 		return encoderCloser{
 			encode: func(v *dto.MetricFamily) error {
 				_, err := MetricFamilyToOpenMetrics(w, model.EscapeMetricFamily(v, escapingScheme), options...)
@@ -42,6 +42,8 @@ const (
 	OpenMetricsVersion_0_0_1 = "0.0.1"
 	//nolint:revive // Allow for underscores.
 	OpenMetricsVersion_1_0_0 = "1.0.0"
+	//nolint:revive // Allow for underscores.
+	OpenMetricsVersion_2_0_0 = "2.0.0"

 	// The Content-Type values for the different wire protocols. Do not do direct
 	// comparisons to these constants, instead use the comparison functions.
@@ -59,6 +61,8 @@ const (
 	// Deprecated: Use expfmt.NewFormat(expfmt.TypeOpenMetrics) instead.
 	//nolint:revive // Allow for underscores.
 	FmtOpenMetrics_1_0_0 Format = OpenMetricsType + `; version=` + OpenMetricsVersion_1_0_0 + `; charset=utf-8`
+	//nolint:revive // Allow for underscores.
+	fmtOpenMetrics_2_0_0 Format = OpenMetricsType + `; version=` + OpenMetricsVersion_2_0_0 + `; charset=utf-8`
 	// Deprecated: Use expfmt.NewFormat(expfmt.TypeOpenMetrics) instead.
 	//nolint:revive // Allow for underscores.
 	FmtOpenMetrics_0_0_1 Format = OpenMetricsType + `; version=` + OpenMetricsVersion_0_0_1 + `; charset=utf-8`
@@ -107,6 +111,9 @@ func NewFormat(t FormatType) Format {

 // NewOpenMetricsFormat generates a new OpenMetrics format matching the
 // specified version number.
+//
+// Note: OpenMetrics version 2.0.0 is experimental and encode-only (currently
+// supporting counter, gauge, and untyped metric types).
 func NewOpenMetricsFormat(version string) (Format, error) {
 	if version == OpenMetricsVersion_0_0_1 {
 		return FmtOpenMetrics_0_0_1, nil
@@ -114,6 +121,10 @@ func NewOpenMetricsFormat(version string) (Format, error) {
 	if version == OpenMetricsVersion_1_0_0 {
 		return FmtOpenMetrics_1_0_0, nil
 	}
+	if version == OpenMetricsVersion_2_0_0 {
+		// OpenMetrics 2.0.0 is experimental and encode-only (counter/gauge/untyped).
+		return fmtOpenMetrics_2_0_0, nil
+	}
 	return FmtUnknown, errors.New("unknown open metrics version string")
 }

@@ -0,0 +1,425 @@
+// Copyright The Prometheus Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package expfmt
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"io"
+	"math"
+	"strconv"
+	"strings"
+
+	dto "github.com/prometheus/client_model/go"
+	"google.golang.org/protobuf/types/known/timestamppb"
+)
+
+// MetricFamilyToOpenMetrics20 converts a MetricFamily proto message into the
+// OpenMetrics text format version 2.0.0 and writes the resulting lines to 'out'.
+// It returns the number of bytes written and any error encountered.
+//
+// NOTE: This method targets OpenMetrics 2.0.0 (currently aligned with 2.0-rc.0) which is experimental and
+// encode-only (currently supporting counter, gauge, and untyped metric types).
+// Breaking changes might happen in the future. This implementation is still a
+// work-in-progress, and does not yet support all features of the format.
+// EncoderOptions are accepted for signature compatibility with
+// MetricFamilyToOpenMetrics and are currently ignored.
+func MetricFamilyToOpenMetrics20(out io.Writer, in *dto.MetricFamily, options ...EncoderOption) (written int, err error) {
+	// Options are accepted for signature compatibility and ignored.
+	_ = options
+	name := in.GetName()
+	if name == "" {
+		return 0, fmt.Errorf("MetricFamily has no name: %s", in)
+	}
+	if containsRawNewline(name) {
+		return 0, fmt.Errorf("MetricFamily name %q contains raw newlines", name)
+	}
+	if in.Unit != nil && containsRawNewline(*in.Unit) {
+		return 0, fmt.Errorf("MetricFamily unit %q contains raw newlines", *in.Unit)
+	}
+
+	// Try the interface upgrade. If it doesn't work, we'll use a
+	// bufio.Writer from the sync.Pool.
+	w, ok := out.(enhancedWriter)
+	if !ok {
+		b := bufPool.Get().(*bufio.Writer)
+		b.Reset(out)
+		w = b
+		defer func() {
+			bErr := b.Flush()
+			if err == nil {
+				err = bErr
+			}
+			bufPool.Put(b)
+		}()
+	}
+
+	var (
+		n          int
+		metricType = in.GetType()
+	)
+
+	// Comments, first HELP, then TYPE.
+	if in.Help != nil {
+		n, err = w.WriteString("# HELP ")
+		written += n
+		if err != nil {
+			return written, err
+		}
+		n, err = writeName(w, name)
+		written += n
+		if err != nil {
+			return written, err
+		}
+		err = w.WriteByte(' ')
+		written++
+		if err != nil {
+			return written, err
+		}
+		n, err = writeEscapedString(w, *in.Help, true)
+		written += n
+		if err != nil {
+			return written, err
+		}
+		err = w.WriteByte('\n')
+		written++
+		if err != nil {
+			return written, err
+		}
+	}
+	n, err = w.WriteString("# TYPE ")
+	written += n
+	if err != nil {
+		return written, err
+	}
+	n, err = writeName(w, name)
+	written += n
+	if err != nil {
+		return written, err
+	}
+	switch metricType {
+	case dto.MetricType_COUNTER:
+		n, err = w.WriteString(" counter\n")
+	case dto.MetricType_GAUGE:
+		n, err = w.WriteString(" gauge\n")
+	case dto.MetricType_SUMMARY:
+		n, err = w.WriteString(" summary\n")
+	case dto.MetricType_UNTYPED:
+		n, err = w.WriteString(" unknown\n")
+	case dto.MetricType_HISTOGRAM:
+		n, err = w.WriteString(" histogram\n")
+	case dto.MetricType_GAUGE_HISTOGRAM:
+		n, err = w.WriteString(" gaugehistogram\n")
+	default:
+		// TODO: Support Info and StateSet once they are supported in the
+		// Prometheus protobuf format.
+		return written, fmt.Errorf("unknown metric type %s", metricType.String())
+	}
+	written += n
+	if err != nil {
+		return written, err
+	}
+	if in.Unit != nil {
+		n, err = w.WriteString("# UNIT ")
+		written += n
+		if err != nil {
+			return written, err
+		}
+		n, err = writeName(w, name)
+		written += n
+		if err != nil {
+			return written, err
+		}
+
+		err = w.WriteByte(' ')
+		written++
+		if err != nil {
+			return written, err
+		}
+		n, err = writeEscapedString(w, *in.Unit, true)
+		written += n
+		if err != nil {
+			return written, err
+		}
+		err = w.WriteByte('\n')
+		written++
+		if err != nil {
+			return written, err
+		}
+	}
+
+	// Finally the samples, one line for each.
+	for _, metric := range in.Metric {
+		if metric == nil {
+			return written, fmt.Errorf("expected non-nil metric in MetricFamily %s", name)
+		}
+		switch metricType {
+		case dto.MetricType_COUNTER:
+			if metric.Counter == nil {
+				return written, fmt.Errorf("expected counter in metric %s %s", name, metric)
+			}
+			val := metric.Counter.GetValue()
+			if math.IsNaN(val) {
+				return written, fmt.Errorf("counter value cannot be NaN in metric %s", name)
+			}
+			if val < 0 {
+				return written, fmt.Errorf("counter value cannot be negative (%g) in metric %s", val, name)
+			}
+			n, err = writeOpenMetrics20Sample(w, name, metric, val, 0, false, metric.Counter.CreatedTimestamp, metric.Counter.Exemplar)
+		case dto.MetricType_GAUGE:
+			if metric.Gauge == nil {
+				return written, fmt.Errorf("expected gauge in metric %s %s", name, metric)
+			}
+			n, err = writeOpenMetrics20Sample(w, name, metric, metric.Gauge.GetValue(), 0, false, nil, nil)
+		case dto.MetricType_UNTYPED:
+			if metric.Untyped == nil {
+				return written, fmt.Errorf("expected untyped in metric %s %s", name, metric)
+			}
+			n, err = writeOpenMetrics20Sample(w, name, metric, metric.Untyped.GetValue(), 0, false, nil, nil)
+		case dto.MetricType_SUMMARY:
+			if metric.Summary == nil {
+				return written, fmt.Errorf("expected summary in metric %s %s", name, metric)
+			}
+			n, err = writeCompositeSummary(w, name, metric)
+		case dto.MetricType_HISTOGRAM, dto.MetricType_GAUGE_HISTOGRAM:
+			if metric.Histogram == nil {
+				return written, fmt.Errorf("expected histogram in metric %s %s", name, metric)
+			}
+			n, err = writeCompositeHistogram(w, name, metric, metricType == dto.MetricType_GAUGE_HISTOGRAM)
+		default:
+			return written, fmt.Errorf("unexpected type in metric %s %s", name, metric)
+		}
+		written += n
+		if err != nil {
+			return written, err
+		}
+	}
+	return written, nil
+}
+
+// writeOpenMetrics20Sample writes a single sample for simple types (Counter, Gauge, Untyped).
+func writeOpenMetrics20Sample(w enhancedWriter, name string, metric *dto.Metric, floatValue float64, intValue uint64, useIntValue bool, startTimestamp *timestamppb.Timestamp, exemplar *dto.Exemplar) (int, error) {
+	if err := validateLabels20(metric.Label); err != nil {
+		return 0, err
+	}
+	written := 0
+	n, err := writeOpenMetricsNameAndLabelPairs(w, name, metric.Label, "", 0)
+	written += n
+	if err != nil {
+		return written, err
+	}
+	err = w.WriteByte(' ')
+	written++
+	if err != nil {
+		return written, err
+	}
+
+	if useIntValue {
+		n, err = writeUint(w, intValue)
+	} else {
+		n, err = writeOpenMetricsFloat(w, floatValue)
+	}
+	written += n
+	if err != nil {
+		return written, err
+	}
+
+	if metric.TimestampMs != nil {
+		err = w.WriteByte(' ')
+		written++
+		if err != nil {
+			return written, err
+		}
+		n, err = writeOpenMetrics20Timestamp(w, float64(*metric.TimestampMs)/1000)
+		written += n
+		if err != nil {
+			return written, err
+		}
+	}
+
+	// Start Timestamp
+	if startTimestamp != nil {
+		if err := startTimestamp.CheckValid(); err != nil {
+			return written, fmt.Errorf("invalid created timestamp in metric %s: %w", name, err)
+		}
+		n, err = w.WriteString(" st@")
+		written += n
+		if err != nil {
+			return written, err
+		}
+		n, err = writeProtoTimestamp(w, startTimestamp)
+		written += n
+		if err != nil {
+			return written, err
+		}
+	}
+
+	if exemplar != nil {
+		n, err = writeExemplar20(w, exemplar)
+		written += n
+		if err != nil {
+			return written, err
+		}
+	}
+
+	err = w.WriteByte('\n')
+	written++
+	if err != nil {
+		return written, err
+	}
+	return written, nil
+}
+
+// writeExemplar20 writes the provided exemplar in OpenMetrics 2.0 format to w.
+// In OpenMetrics 2.0, invalid exemplars or exemplars without a timestamp are dropped.
+func writeExemplar20(w enhancedWriter, e *dto.Exemplar) (int, error) {
+	if e == nil {
+		return 0, nil
+	}
+	// In OpenMetrics 2.0, invalid exemplars are dropped rather than failing the entire exposition.
+	if err := validateExemplar20(e); err != nil {
+		return 0, nil
+	}
+	written := 0
+	n, err := w.WriteString(" # ")
+	written += n
+	if err != nil {
+		return written, err
+	}
+	if len(e.Label) == 0 {
+		n, err = w.WriteString("{}")
+	} else {
+		n, err = writeOpenMetricsNameAndLabelPairs(w, "", e.Label, "", 0)
+	}
+	written += n
+	if err != nil {
+		return written, err
+	}
+	err = w.WriteByte(' ')
+	written++
+	if err != nil {
+		return written, err
+	}
+	n, err = writeOpenMetricsFloat(w, e.GetValue())
+	written += n
+	if err != nil {
+		return written, err
+	}
+	err = w.WriteByte(' ')
+	written++
+	if err != nil {
+		return written, err
+	}
+	ts := e.Timestamp
+	n, err = writeProtoTimestamp(w, ts)
+	written += n
+	if err != nil {
+		return written, err
+	}
+	return written, nil
+}
+
+// writeOpenMetrics20Timestamp writes a float64 as a timestamp without scientific notation.
+func writeOpenMetrics20Timestamp(w enhancedWriter, f float64) (int, error) {
+	bp := numBufPool.Get().(*[]byte)
+	*bp = strconv.AppendFloat((*bp)[:0], f, 'f', -1, 64)
+	written, err := w.Write(*bp)
+	numBufPool.Put(bp)
+	return written, err
+}
+
+// Stubs for Summary and Histogram
+
+func writeCompositeSummary(w enhancedWriter, name string, metric *dto.Metric) (int, error) {
+	_ = w
+	_ = name
+	_ = metric
+	return 0, errors.New("summary not implemented yet")
+}
+
+func writeCompositeHistogram(w enhancedWriter, name string, metric *dto.Metric, isGauge bool) (int, error) {
+	_ = w
+	_ = name
+	_ = metric
+	_ = isGauge
+	return 0, errors.New("histogram not implemented yet")
+}
+
+func validateLabels20(labels []*dto.LabelPair) error {
+	for _, lp := range labels {
+		if lp == nil {
+			return errors.New("expected non-nil label pair")
+		}
+		lname := lp.GetName()
+		if lname == "" {
+			return errors.New("label name cannot be empty")
+		}
+		if containsRawNewline(lname) {
+			return fmt.Errorf("label name %q contains raw newlines", lname)
+		}
+	}
+	return nil
+}
+
+func containsRawNewline(s string) bool {
+	return strings.IndexByte(s, '\n') >= 0 || strings.IndexByte(s, '\r') >= 0
+}
+
+func validateExemplar20(e *dto.Exemplar) error {
+	if e.Timestamp == nil {
+		return errors.New("exemplar timestamp is required")
+	}
+	if err := e.Timestamp.CheckValid(); err != nil {
+		return err
+	}
+	return validateLabels20(e.Label)
+}
+
+func writeProtoTimestamp(w enhancedWriter, ts *timestamppb.Timestamp) (int, error) {
+	if err := ts.CheckValid(); err != nil {
+		return 0, err
+	}
+	n, err := writeInt(w, ts.Seconds)
+	if err != nil {
+		return n, err
+	}
+	if ts.Nanos == 0 {
+		return n, nil
+	}
+	err = w.WriteByte('.')
+	written := n + 1
+	if err != nil {
+		return written, err
+	}
+	bp := numBufPool.Get().(*[]byte)
+	*bp = strconv.AppendInt((*bp)[:0], int64(ts.Nanos), 10)
+	pad := 9 - len(*bp)
+	for range pad {
+		err = w.WriteByte('0')
+		written++
+		if err != nil {
+			numBufPool.Put(bp)
+			return written, err
+		}
+	}
+	val := *bp
+	for len(val) > 0 && val[len(val)-1] == '0' {
+		val = val[:len(val)-1]
+	}
+	n2, err := w.Write(val)
+	written += n2
+	numBufPool.Put(bp)
+	return written, err
+}
@@ -14,7 +14,7 @@
 package model

 import (
-	"sort"
+	"slices"
 )

 // SeparatorByte is a byte that cannot occur in valid UTF-8 sequences and is
@@ -37,7 +37,7 @@ func LabelsToSignature(labels map[string]string) uint64 {
 	for labelName := range labels {
 		labelNames = append(labelNames, labelName)
 	}
-	sort.Strings(labelNames)
+	slices.Sort(labelNames)

 	sum := hashNew()
 	for _, labelName := range labelNames {
@@ -60,7 +60,7 @@ func labelSetToFingerprint(ls LabelSet) Fingerprint {
 	for labelName := range ls {
 		labelNames = append(labelNames, labelName)
 	}
-	sort.Sort(labelNames)
+	slices.Sort(labelNames)

 	sum := hashNew()
 	for _, labelName := range labelNames {
@@ -100,7 +100,7 @@ func SignatureForLabels(m Metric, labels ...LabelName) uint64 {
 		return emptyLabelSignature
 	}

-	sort.Sort(LabelNames(labels))
+	slices.Sort(labels)

 	sum := hashNew()
 	for _, label := range labels {
@@ -129,7 +129,7 @@ func SignatureWithoutLabels(m Metric, labels map[LabelName]struct{}) uint64 {
 	if len(labelNames) == 0 {
 		return emptyLabelSignature
 	}
-	sort.Sort(labelNames)
+	slices.Sort(labelNames)

 	sum := hashNew()
 	for _, labelName := range labelNames {
@@ -164,6 +164,34 @@ func (t *Time) UnmarshalJSON(b []byte) error {
 // This type should not propagate beyond the scope of input/output processing.
 type Duration time.Duration

+// Common durations. Day and Week are included because ParseDuration supports
+// those units (unlike the standard time package).
+//
+// To count the number of units in a Duration, divide:
+//
+//	second := model.Second
+//	fmt.Print(int64(second/model.Millisecond)) // prints 1000
+//
+// To convert an integer number of units to a Duration, multiply:
+//
+//	seconds := 10
+//	fmt.Print(model.Duration(seconds)*model.Second) // prints 10s
+const (
+	Nanosecond  Duration = 1
+	Microsecond          = 1000 * Nanosecond
+	Millisecond          = 1000 * Microsecond
+	Second               = 1000 * Millisecond
+	Minute               = 60 * Second
+	Hour                 = 60 * Minute
+	Day                  = 24 * Hour
+	Week                 = 7 * Day
+)
+
+// Milliseconds returns the duration as an integer millisecond count.
+// Prometheus stores timestamps in milliseconds; time.Duration already
+// covers the other units.
+func (d Duration) Milliseconds() int64 { return time.Duration(d).Milliseconds() }
+
 // Set implements pflag/flag.Value.
 func (d *Duration) Set(s string) error {
 	var err error
@@ -4,7 +4,9 @@

 package http2

-import "strings"
+import (
+	"strings"
+)

 // The HTTP protocols are defined in terms of ASCII, not Unicode. This file
 // contains helper functions which may use Unicode-aware functions which would
@@ -43,6 +45,16 @@ func isASCIIPrint(s string) bool {
 	return true
 }

+// isASCII returns whether s is ASCII.
+func isASCII(s string) bool {
+	for i := 0; i < len(s); i++ {
+		if s[i] > 0x7f {
+			return false
+		}
+	}
+	return true
+}
+
 // asciiToLower returns the lowercase version of s if s is ASCII and printable,
 // and whether or not it was.
 func asciiToLower(s string) (lower string, ok bool) {
@@ -121,10 +121,7 @@ func (b *dataBuffer) Write(p []byte) (int, error) {
 		// If the last chunk is empty, allocate a new chunk. Try to allocate
 		// enough to fully copy p plus any additional bytes we expect to
 		// receive. However, this may allocate less than len(p).
-		want := int64(len(p))
-		if b.expected > want {
-			want = b.expected
-		}
+		want := max(int64(len(p)), b.expected)
 		chunk := b.lastChunkOrAlloc(want)
 		n := copy(chunk[b.w:], p)
 		p = p[n:]
@@ -25,6 +25,8 @@ import (
 //
 //	https://golang.org/pkg/net/http/#ResponseWriter
 //	https://golang.org/pkg/net/http/#example_ResponseWriter_trailers
+//
+// Deprecated: Use [http.TrailerPrefix] instead.
 const TrailerPrefix = "Trailer:"

 // Push errors.
@@ -38,16 +40,22 @@ var (
 // The configuration conf may be nil.
 //
 // ConfigureServer must be called before s begins serving.
+//
+// Deprecated: Set [http.Server.Protocols] instead.
 func ConfigureServer(s *http.Server, conf *Server) error {
 	return configureServer(s, conf)
 }

 // Server is an HTTP/2 server.
+//
+// Deprecated: Use [http.Server] instead.
 type Server struct {
 	// MaxHandlers limits the number of http.Handler ServeHTTP goroutines
 	// which may run at a time over all connections.
 	// Negative or zero no limit.
 	// TODO: implement
+	//
+	// Deprecated: This field has never had any effect.
 	MaxHandlers int

 	// MaxConcurrentStreams optionally specifies the number of
@@ -56,6 +64,9 @@ type Server struct {
 	// which may be active globally, which is MaxHandlers.
 	// If zero, MaxConcurrentStreams defaults to at least 100, per
 	// the HTTP/2 spec's recommendations.
+	//
+	// Deprecated: Use [http.Server.HTTP2] and
+	// [http.HTTP2Config.MaxConcurrentStreams] instead.
 	MaxConcurrentStreams uint32

 	// MaxDecoderHeaderTableSize optionally specifies the http2
@@ -63,44 +74,67 @@ type Server struct {
 	// informs the remote endpoint of the maximum size of the header compression
 	// table used to decode header blocks, in octets. If zero, the default value
 	// of 4096 is used.
+	//
+	// Deprecated: Use [http.Server.HTTP2] and
+	// [http.HTTP2Config.MaxDecoderHeaderTableSize] instead.
 	MaxDecoderHeaderTableSize uint32

 	// MaxEncoderHeaderTableSize optionally specifies an upper limit for the
 	// header compression table used for encoding request headers. Received
 	// SETTINGS_HEADER_TABLE_SIZE settings are capped at this limit. If zero,
 	// the default value of 4096 is used.
+	//
+	// Deprecated: Use [http.Server.HTTP2] and
+	// [http.HTTP2Config.MaxEncoderHeaderTableSize] instead.
 	MaxEncoderHeaderTableSize uint32

 	// MaxReadFrameSize optionally specifies the largest frame
 	// this server is willing to read. A valid value is between
 	// 16k and 16M, inclusive. If zero or otherwise invalid, a
 	// default value is used.
+	//
+	// Deprecated: Use [http.Server.HTTP2] and
+	// [http.HTTP2Config.MaxReadFrameSize] instead.
 	MaxReadFrameSize uint32

 	// PermitProhibitedCipherSuites, if true, permits the use of
 	// cipher suites prohibited by the HTTP/2 spec.
+	//
+	// Deprecated: Use [http.Server.HTTP2] and
+	// [http.HTTP2Config.PermitProhibitedCipherSuites] instead.
 	PermitProhibitedCipherSuites bool

 	// IdleTimeout specifies how long until idle clients should be
 	// closed with a GOAWAY frame. PING frames are not considered
 	// activity for the purposes of IdleTimeout.
 	// If zero or negative, there is no timeout.
+	//
+	// Deprecated: Use [http.Server.IdleTimeout] instead.
 	IdleTimeout time.Duration

 	// ReadIdleTimeout is the timeout after which a health check using a ping
 	// frame will be carried out if no frame is received on the connection.
 	// If zero, no health check is performed.
+	//
+	// Deprecated: Use [http.Server.HTTP2] and
+	// [http.HTTP2Config.SendPingTimeout] instead.
 	ReadIdleTimeout time.Duration

 	// PingTimeout is the timeout after which the connection will be closed
 	// if a response to a ping is not received.
 	// If zero, a default of 15 seconds is used.
+	//
+	// Deprecated: Use [http.Server.HTTP2] and
+	// [http.HTTP2Config.PingTimeout] instead.
 	PingTimeout time.Duration

 	// WriteByteTimeout is the timeout after which a connection will be
 	// closed if no data can be written to it. The timeout begins when data is
 	// available to write, and is extended whenever any bytes are written.
 	// If zero or negative, there is no timeout.
+	//
+	// Deprecated: Use [http.Server.HTTP2] and
+	// [http.HTTP2Config.WriteByteTimeout] instead.
 	WriteByteTimeout time.Duration

 	// MaxUploadBufferPerConnection is the size of the initial flow
@@ -108,12 +142,18 @@ type Server struct {
 	// allow this to be smaller than 65535 or larger than 2^32-1.
 	// If the value is outside this range, a default value will be
 	// used instead.
+	//
+	// Deprecated: Use [http.Server.HTTP2] and
+	// [http.HTTP2Config.MaxReceiveBufferPerConnection] instead.
 	MaxUploadBufferPerConnection int32

 	// MaxUploadBufferPerStream is the size of the initial flow control
 	// window for each stream. The HTTP/2 spec does not allow this to
 	// be larger than 2^32-1. If the value is zero or larger than the
 	// maximum, a default value will be used instead.
+	//
+	// Deprecated: Use [http.Server.HTTP2] and
+	// [http.HTTP2Config.MaxReceiveBufferPerStream] instead.
 	MaxUploadBufferPerStream int32

 	// NewWriteScheduler constructs a write scheduler for a connection.
@@ -126,6 +166,9 @@ type Server struct {
 	// It's intended to increment a metric for monitoring, such
 	// as an expvar or Prometheus metric.
 	// The errType consists of only ASCII word characters.
+	//
+	// Deprecated: Use [http.Server.HTTP2] and
+	// [http.HTTP2Config.CountError] instead.
 	CountError func(errType string)

 	// Internal state. This is a pointer (rather than embedded directly)
@@ -135,6 +178,8 @@ type Server struct {
 }

 // ServeConnOpts are options for the Server.ServeConn method.
+//
+// Deprecated: ServeConnOpts is deprecated.
 type ServeConnOpts struct {
 	// Context is the base context to use.
 	// If nil, context.Background is used.
@@ -178,6 +223,8 @@ type ServeConnOpts struct {
 // implemented in terms of providing a suitably-behaving net.Conn.
 //
 // The opts parameter is optional. If nil, default values are used.
+//
+// Deprecated: Use [http.Server.Serve] or [http.Server.ServeTLS] instead.
 func (s *Server) ServeConn(c net.Conn, opts *ServeConnOpts) {
 	if opts == nil {
 		opts = &ServeConnOpts{}
@@ -184,6 +184,8 @@ func (t *Transport) initConnPool() {

 // ClientConn is the state of a single HTTP/2 client connection to an
 // HTTP/2 server.
+//
+// Deprecated: Use [http.ClientConn] instead.
 type ClientConn struct {
 	t             *Transport
 	tconn         net.Conn             // usually *tls.Conn, except specialized impls