diff --git a/.golangci.yml b/.golangci.yml
index 3dab1de516..80b2944542 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -358,6 +358,12 @@ linters:
         linters:
           - gocheckcompilerdirectives
 
+      # Keep the imported gddo code close to its upstream form.
+      - path: daemon/server/httputils/internal/httputil/
+        linters:
+          - gocritic
+          - nakedret
+
     # Log a warning if an exclusion rule is unused.
     # Default: false
     warn-unused: true
diff --git a/NOTICE b/NOTICE
index 18c6af3bec..74256d4941 100644
--- a/NOTICE
+++ b/NOTICE
@@ -11,6 +11,10 @@ This product contains software derived from RackSec/srslog
 from the Go standard library's log/syslog package, licensed under the
 BSD 3-Clause License.
 
+This product contains software derived from golang/gddo
+(https://github.com/golang/gddo), developed by The Go Authors and licensed
+under the BSD 3-Clause License.
+
 The following is courtesy of our legal counsel:
 
 
diff --git a/daemon/server/httputils/contentencoding/contentencoding.go b/daemon/server/httputils/contentencoding/contentencoding.go
index 0f9e70467d..4421547d68 100644
--- a/daemon/server/httputils/contentencoding/contentencoding.go
+++ b/daemon/server/httputils/contentencoding/contentencoding.go
@@ -5,7 +5,7 @@ package contentencoding
 import (
 	"net/http"
 
-	"github.com/golang/gddo/httputil"
+	"github.com/moby/moby/v2/daemon/server/httputils/internal/httputil"
 )
 
 // Negotiate returns the best offered content encoding for the request's
diff --git a/daemon/server/httputils/contenttype/contenttype.go b/daemon/server/httputils/contenttype/contenttype.go
index 9adea1765d..4ee1e5aa44 100644
--- a/daemon/server/httputils/contenttype/contenttype.go
+++ b/daemon/server/httputils/contenttype/contenttype.go
@@ -3,8 +3,8 @@ package contenttype
 import (
 	"net/http"
 
-	"github.com/golang/gddo/httputil"
-	"github.com/golang/gddo/httputil/header"
+	"github.com/moby/moby/v2/daemon/server/httputils/internal/httputil"
+	"github.com/moby/moby/v2/daemon/server/httputils/internal/httputil/header"
 )
 
 // MatchAcceptStrict returns the best matching offer explicitly listed in the
diff --git a/vendor/github.com/golang/gddo/LICENSE b/daemon/server/httputils/internal/httputil/LICENSE
similarity index 100%
rename from vendor/github.com/golang/gddo/LICENSE
rename to daemon/server/httputils/internal/httputil/LICENSE
diff --git a/daemon/server/httputils/internal/httputil/README.md b/daemon/server/httputils/internal/httputil/README.md
new file mode 100644
index 0000000000..6cf7fb6df7
--- /dev/null
+++ b/daemon/server/httputils/internal/httputil/README.md
@@ -0,0 +1,6 @@
+# httputil
+
+> **Note:** This package is a hard fork of [github.com/golang/gddo/httputil](https://github.com/golang/gddo/tree/master/httputil),
+> imported from commit `20d68f94ee1f7547de2b1c68627253df20c8d45e`. It is
+> maintained as an internal package of Moby and is not intended to track
+> the original upstream repository.
diff --git a/vendor/github.com/golang/gddo/httputil/header/header.go b/daemon/server/httputils/internal/httputil/header/header.go
similarity index 95%
rename from vendor/github.com/golang/gddo/httputil/header/header.go
rename to daemon/server/httputils/internal/httputil/header/header.go
index 0f1572e3f9..1e437cb74c 100644
--- a/vendor/github.com/golang/gddo/httputil/header/header.go
+++ b/daemon/server/httputils/internal/httputil/header/header.go
@@ -44,8 +44,8 @@ func init() {
 		var t octetType
 		isCtl := c <= 31 || c == 127
 		isChar := 0 <= c && c <= 127
-		isSeparator := strings.IndexRune(" \t\"(),/:;<=>?@[]\\{}", rune(c)) >= 0
-		if strings.IndexRune(" \t\r\n", rune(c)) >= 0 {
+		isSeparator := strings.ContainsRune(" \t\"(),/:;<=>?@[]\\{}", rune(c))
+		if strings.ContainsRune(" \t\r\n", rune(c)) {
 			t |= isSpace
 		}
 		if isChar && !isCtl && !isSeparator {
@@ -55,15 +55,6 @@ func init() {
 	}
 }
 
-// Copy returns a shallow copy of the header.
-func Copy(header http.Header) http.Header {
-	h := make(http.Header)
-	for k, vs := range header {
-		h[k] = vs
-	}
-	return h
-}
-
 var timeLayouts = []string{"Mon, 02 Jan 2006 15:04:05 GMT", time.RFC850, time.ANSIC}
 
 // ParseTime parses the header as time. The zero value is returned if the
diff --git a/daemon/server/httputils/internal/httputil/header/header_test.go b/daemon/server/httputils/internal/httputil/header/header_test.go
new file mode 100644
index 0000000000..97c8685899
--- /dev/null
+++ b/daemon/server/httputils/internal/httputil/header/header_test.go
@@ -0,0 +1,139 @@
+// Copyright 2013 The Go Authors. All rights reserved.
+//
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file or at
+// https://developers.google.com/open-source/licenses/bsd.
+
+package header
+
+import (
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+var getHeaderListTests = []struct {
+	s string
+	l []string
+}{
+	{s: `a`, l: []string{`a`}},
+	{s: `a, b , c `, l: []string{`a`, `b`, `c`}},
+	{s: `a,, b , , c `, l: []string{`a`, `b`, `c`}},
+	{s: `a,b,c`, l: []string{`a`, `b`, `c`}},
+	{s: ` a b, c d `, l: []string{`a b`, `c d`}},
+	{s: `"a, b, c", d `, l: []string{`"a, b, c"`, "d"}},
+	{s: `","`, l: []string{`","`}},
+	{s: `"\""`, l: []string{`"\""`}},
+	{s: `" "`, l: []string{`" "`}},
+}
+
+func TestGetHeaderList(t *testing.T) {
+	for _, tt := range getHeaderListTests {
+		header := http.Header{"Foo": {tt.s}}
+		if l := ParseList(header, "foo"); !cmp.Equal(tt.l, l) {
+			t.Errorf("ParseList for %q = %q, want %q", tt.s, l, tt.l)
+		}
+	}
+}
+
+var parseValueAndParamsTests = []struct {
+	s      string
+	value  string
+	params map[string]string
+}{
+	{`text/html`, "text/html", map[string]string{}},
+	{`text/html  `, "text/html", map[string]string{}},
+	{`text/html ; `, "text/html", map[string]string{}},
+	{`tExt/htMl`, "text/html", map[string]string{}},
+	{`tExt/htMl; fOO=";"; hellO=world`, "text/html", map[string]string{
+		"hello": "world",
+		"foo":   `;`,
+	}},
+	{`text/html; foo=bar, hello=world`, "text/html", map[string]string{"foo": "bar"}},
+	{`text/html ; foo=bar `, "text/html", map[string]string{"foo": "bar"}},
+	{`text/html ;foo=bar `, "text/html", map[string]string{"foo": "bar"}},
+	{`text/html; foo="b\ar"`, "text/html", map[string]string{"foo": "bar"}},
+	{`text/html; foo="bar\"baz\"qux"`, "text/html", map[string]string{"foo": `bar"baz"qux`}},
+	{`text/html; foo="b,ar"`, "text/html", map[string]string{"foo": "b,ar"}},
+	{`text/html; foo="b;ar"`, "text/html", map[string]string{"foo": "b;ar"}},
+	{`text/html; FOO="bar"`, "text/html", map[string]string{"foo": "bar"}},
+	{`form-data; filename="file.txt"; name=file`, "form-data", map[string]string{"filename": "file.txt", "name": "file"}},
+}
+
+func TestParseValueAndParams(t *testing.T) {
+	for _, tt := range parseValueAndParamsTests {
+		header := http.Header{"Content-Type": {tt.s}}
+		value, params := ParseValueAndParams(header, "Content-Type")
+		if value != tt.value {
+			t.Errorf("%q, value=%q, want %q", tt.s, value, tt.value)
+		}
+		if !cmp.Equal(params, tt.params) {
+			t.Errorf("%q, param=%#v, want %#v", tt.s, params, tt.params)
+		}
+	}
+}
+
+var parseTimeValidTests = []string{
+	"Sun, 06 Nov 1994 08:49:37 GMT",
+	"Sunday, 06-Nov-94 08:49:37 GMT",
+	"Sun Nov  6 08:49:37 1994",
+}
+
+var parseTimeInvalidTests = []string{
+	"junk",
+}
+
+func TestParseTime(t *testing.T) {
+	expected := time.Date(1994, 11, 6, 8, 49, 37, 0, time.UTC)
+	for _, s := range parseTimeValidTests {
+		header := http.Header{"Date": {s}}
+		actual := ParseTime(header, "Date")
+		if actual != expected {
+			t.Errorf("GetTime(%q)=%v, want %v", s, actual, expected)
+		}
+	}
+	for _, s := range parseTimeInvalidTests {
+		header := http.Header{"Date": {s}}
+		actual := ParseTime(header, "Date")
+		if !actual.IsZero() {
+			t.Errorf("GetTime(%q) did not return zero", s)
+		}
+	}
+}
+
+var parseAcceptTests = []struct {
+	s        string
+	expected []AcceptSpec
+}{
+	{"text/html", []AcceptSpec{{"text/html", 1}}},
+	{"text/html; q=0", []AcceptSpec{{"text/html", 0}}},
+	{"text/html; q=0.0", []AcceptSpec{{"text/html", 0}}},
+	{"text/html; q=1", []AcceptSpec{{"text/html", 1}}},
+	{"text/html; q=1.0", []AcceptSpec{{"text/html", 1}}},
+	{"text/html; q=0.1", []AcceptSpec{{"text/html", 0.1}}},
+	{"text/html;q=0.1", []AcceptSpec{{"text/html", 0.1}}},
+	{"text/html, text/plain", []AcceptSpec{{"text/html", 1}, {"text/plain", 1}}},
+	{"text/html; q=0.1, text/plain", []AcceptSpec{{"text/html", 0.1}, {"text/plain", 1}}},
+	{"iso-8859-5, unicode-1-1;q=0.8,iso-8859-1", []AcceptSpec{{"iso-8859-5", 1}, {"unicode-1-1", 0.8}, {"iso-8859-1", 1}}},
+	{"iso-8859-1", []AcceptSpec{{"iso-8859-1", 1}}},
+	{"*", []AcceptSpec{{"*", 1}}},
+	{"da, en-gb;q=0.8, en;q=0.7", []AcceptSpec{{"da", 1}, {"en-gb", 0.8}, {"en", 0.7}}},
+	{"da, q, en-gb;q=0.8", []AcceptSpec{{"da", 1}, {"q", 1}, {"en-gb", 0.8}}},
+	{"image/png, image/*;q=0.5", []AcceptSpec{{"image/png", 1}, {"image/*", 0.5}}},
+
+	// bad cases
+	{"value1; q=0.1.2", []AcceptSpec{{"value1", 0.1}}},
+	{"da, en-gb;q=foo", []AcceptSpec{{"da", 1}}},
+}
+
+func TestParseAccept(t *testing.T) {
+	for _, tt := range parseAcceptTests {
+		header := http.Header{"Accept": {tt.s}}
+		actual := ParseAccept(header, "Accept")
+		if !cmp.Equal(actual, tt.expected) {
+			t.Errorf("ParseAccept(h, %q)=%v, want %v", tt.s, actual, tt.expected)
+		}
+	}
+}
diff --git a/vendor/github.com/golang/gddo/httputil/negotiate.go b/daemon/server/httputils/internal/httputil/negotiate.go
similarity index 96%
rename from vendor/github.com/golang/gddo/httputil/negotiate.go
rename to daemon/server/httputils/internal/httputil/negotiate.go
index 6af3e4ca61..915a364720 100644
--- a/vendor/github.com/golang/gddo/httputil/negotiate.go
+++ b/daemon/server/httputils/internal/httputil/negotiate.go
@@ -7,9 +7,10 @@
 package httputil
 
 import (
-	"github.com/golang/gddo/httputil/header"
 	"net/http"
 	"strings"
+
+	"github.com/moby/moby/v2/daemon/server/httputils/internal/httputil/header"
 )
 
 // NegotiateContentEncoding returns the best offered content encoding for the
diff --git a/daemon/server/httputils/internal/httputil/negotiate_test.go b/daemon/server/httputils/internal/httputil/negotiate_test.go
new file mode 100644
index 0000000000..268d1fd99e
--- /dev/null
+++ b/daemon/server/httputils/internal/httputil/negotiate_test.go
@@ -0,0 +1,72 @@
+// Copyright 2013 The Go Authors. All rights reserved.
+//
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file or at
+// https://developers.google.com/open-source/licenses/bsd.
+
+package httputil_test
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/moby/moby/v2/daemon/server/httputils/internal/httputil"
+)
+
+var negotiateContentEncodingTests = []struct {
+	s      string
+	offers []string
+	expect string
+}{
+	{"", []string{"identity", "gzip"}, "identity"},
+	{"*;q=0", []string{"identity", "gzip"}, ""},
+	{"gzip", []string{"identity", "gzip"}, "gzip"},
+}
+
+func TestNegotiateContentEnoding(t *testing.T) {
+	for _, tt := range negotiateContentEncodingTests {
+		r := &http.Request{Header: http.Header{"Accept-Encoding": {tt.s}}}
+		actual := httputil.NegotiateContentEncoding(r, tt.offers)
+		if actual != tt.expect {
+			t.Errorf("NegotiateContentEncoding(%q, %#v)=%q, want %q", tt.s, tt.offers, actual, tt.expect)
+		}
+	}
+}
+
+var negotiateContentTypeTests = []struct {
+	s            string
+	offers       []string
+	defaultOffer string
+	expect       string
+}{
+	{"text/html, */*;q=0", []string{"x/y"}, "", ""},
+	{"text/html, */*", []string{"x/y"}, "", "x/y"},
+	{"text/html, image/png", []string{"text/html", "image/png"}, "", "text/html"},
+	{"text/html, image/png", []string{"image/png", "text/html"}, "", "image/png"},
+	{"text/html, image/png; q=0.5", []string{"image/png"}, "", "image/png"},
+	{"text/html, image/png; q=0.5", []string{"text/html"}, "", "text/html"},
+	{"text/html, image/png; q=0.5", []string{"foo/bar"}, "", ""},
+	{"text/html, image/png; q=0.5", []string{"image/png", "text/html"}, "", "text/html"},
+	{"text/html, image/png; q=0.5", []string{"text/html", "image/png"}, "", "text/html"},
+	{"text/html;q=0.5, image/png", []string{"image/png"}, "", "image/png"},
+	{"text/html;q=0.5, image/png", []string{"text/html"}, "", "text/html"},
+	{"text/html;q=0.5, image/png", []string{"image/png", "text/html"}, "", "image/png"},
+	{"text/html;q=0.5, image/png", []string{"text/html", "image/png"}, "", "image/png"},
+	{"image/png, image/*;q=0.5", []string{"image/jpg", "image/png"}, "", "image/png"},
+	{"image/png, image/*;q=0.5", []string{"image/jpg"}, "", "image/jpg"},
+	{"image/png, image/*;q=0.5", []string{"image/jpg", "image/gif"}, "", "image/jpg"},
+	{"image/png, image/*", []string{"image/jpg", "image/gif"}, "", "image/jpg"},
+	{"image/png, image/*", []string{"image/gif", "image/jpg"}, "", "image/gif"},
+	{"image/png, image/*", []string{"image/gif", "image/png"}, "", "image/png"},
+	{"image/png, image/*", []string{"image/png", "image/gif"}, "", "image/png"},
+}
+
+func TestNegotiateContentType(t *testing.T) {
+	for _, tt := range negotiateContentTypeTests {
+		r := &http.Request{Header: http.Header{"Accept": {tt.s}}}
+		actual := httputil.NegotiateContentType(r, tt.offers, tt.defaultOffer)
+		if actual != tt.expect {
+			t.Errorf("NegotiateContentType(%q, %#v, %q)=%q, want %q", tt.s, tt.offers, tt.defaultOffer, actual, tt.expect)
+		}
+	}
+}
diff --git a/go.mod b/go.mod
index d2144f531d..1344fc3a40 100644
--- a/go.mod
+++ b/go.mod
@@ -50,7 +50,6 @@ require (
 	github.com/fluent/fluent-logger-golang v1.10.1
 	github.com/godbus/dbus/v5 v5.2.2
 	github.com/gogo/protobuf v1.3.2
-	github.com/golang/gddo v0.0.0-20210115222349-20d68f94ee1f
 	github.com/google/go-cmp v0.7.0
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/mux v1.8.1
diff --git a/go.sum b/go.sum
index 9d61daa636..89fae6f596 100644
--- a/go.sum
+++ b/go.sum
@@ -1,4 +1,3 @@
-cloud.google.com/go v0.16.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=
 cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU=
 cloud.google.com/go/auth v0.20.0 h1:kXTssoVb4azsVDoUiF8KvxAqrsQcQtB53DcSgta74CA=
@@ -48,7 +47,6 @@ github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEK
 github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.7.0 h1:4iB+IesclUXdP0ICgAabvq2FYLXrJWKx1fJQ+GxSo3Y=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.7.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/DataDog/datadog-go v3.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
 github.com/Graylog2/go-gelf v0.0.0-20191017102106-1550ee647df0 h1:cOjLyhBhe91glgZZNbQUg9BJC57l6BiSKov0Ivv7k0U=
 github.com/Graylog2/go-gelf v0.0.0-20191017102106-1550ee647df0/go.mod h1:fBaQWrftOD5CrVCUfoYGHs4X4VViTuGOXA8WloCjTY0=
@@ -123,7 +121,6 @@ github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdn
 github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
-github.com/bradfitz/gomemcache v0.0.0-20170208213004-1952afaa557d/go.mod h1:PmM6Mmwb0LSuEubjR8N7PtNe1KxZLtOUHtbeikc5h60=
 github.com/brianvoe/gofakeit/v7 v7.12.1 h1:df1tiI4SL1dR5Ix4D/r6a3a+nXBJ/OBGU5jEKRBmmqg=
 github.com/brianvoe/gofakeit/v7 v7.12.1/go.mod h1:QXuPeBw164PJCzCUZVmgpgHJ3Llj49jSLVkKPMtxtxA=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
@@ -252,12 +249,10 @@ github.com/fernet/fernet-go v0.0.0-20240119011108-303da6aec611 h1:JwYtKJ/DVEoIA5
 github.com/fernet/fernet-go v0.0.0-20240119011108-303da6aec611/go.mod h1:zHMNeYgqrTpKyjawjitDg0Osd1P/FmeA0SZLYK3RfLQ=
 github.com/fluent/fluent-logger-golang v1.10.1 h1:wu54iN1O2afll5oQrtTjhgZRwWcfOeFFzwRsEkABfFQ=
 github.com/fluent/fluent-logger-golang v1.10.1/go.mod h1:qOuXG4ZMrXaSTk12ua+uAb21xfNYOzn0roAtp7mfGAE=
-github.com/fsnotify/fsnotify v1.4.3-0.20170329110642-4da3e2cfbabc/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
 github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
 github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
 github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
-github.com/garyburd/redigo v1.1.1-0.20170914051019-70e1b1943d4f/go.mod h1:NR3MbYisc3/PwhQ00EMzDiPmrwpPxAn5GI05/YaO1SY=
 github.com/go-chi/chi/v5 v5.3.0 h1:halUjDxhshgXHMrao5bB8eNBXo/rnzwr8m5m36glehM=
 github.com/go-chi/chi/v5 v5.3.0/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto=
 github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
@@ -324,7 +319,6 @@ github.com/go-openapi/validate v0.26.1/go.mod h1:B8UMgXiQiwwQWIbmuROlwJZDPGlikPu
 github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI=
 github.com/go-quicktest/qt v1.101.0/go.mod h1:14Bz/f7NwaXPtdYEgzsx46kqSxVwTbzVZsDC26tQJow=
 github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
-github.com/go-stack/stack v1.6.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
@@ -343,22 +337,17 @@ github.com/gohugoio/hashstructure v0.6.0 h1:7wMB/2CfXoThFYhdWRGv3u3rUM761Cq29CxU
 github.com/gohugoio/hashstructure v0.6.0/go.mod h1:lapVLk9XidheHG1IQ4ZSbyYrXcaILU1ZEP/+vno5rBQ=
 github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
 github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
-github.com/golang/gddo v0.0.0-20210115222349-20d68f94ee1f h1:16RtHeWGkJMc80Etb8RPCcKevXGldr57+LOyZt8zOlg=
-github.com/golang/gddo v0.0.0-20210115222349-20d68f94ee1f/go.mod h1:ijRvpgDJDI262hYq/IQVYgf8hd8IHUs93Ol0kvMBAx4=
 github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
 github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
-github.com/golang/lint v0.0.0-20170918230701-e5d664eb928e/go.mod h1:tluoj9z5200jBnyusfRPU2LqT6J+DAorxEvtC7LHB+E=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/golang/snappy v0.0.0-20170215233205-553a64147049/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
 github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
 github.com/google/certificate-transparency-go v1.3.3 h1:hq/rSxztSkXN2tx/3jQqF6Xc0O565UQPdHrOWvZwybo=
 github.com/google/certificate-transparency-go v1.3.3/go.mod h1:iR17ZgSaXRzSa5qvjFl8TnVD5h8ky2JMVio+dzoKMgA=
-github.com/google/go-cmp v0.1.1-0.20171103154506-982329095285/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
@@ -381,12 +370,10 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/enterprise-certificate-proxy v0.3.17 h1:73NfMHdiqo9JFU9+7a5ExpVa10/R29pXfZIaW559nrg=
 github.com/googleapis/enterprise-certificate-proxy v0.3.17/go.mod h1:rSEsBUemEBZEexP2y6jPp16LUmUbjmSbcPMQizR0o4k=
-github.com/googleapis/gax-go v2.0.0+incompatible/go.mod h1:SFVmujtThgffbyetf+mdk2eWhX2bMyUtNHzFKcPA9HY=
 github.com/googleapis/gax-go/v2 v2.23.0 h1:Tchl7qkvE7Ip3y+ztvNufYFvkfqTe7NfLTYGIdJRLuE=
 github.com/googleapis/gax-go/v2 v2.23.0/go.mod h1:rBQKOVJCdb8IFEzg+FCwlt1LP/xMDGuqUXhUG+XMXEg=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
-github.com/gregjones/httpcache v0.0.0-20170920190843-316c5e0ff04e/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
 github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 h1:UH//fgunKIs4JdUbpDl1VZCDaL56wXCB/5+wF6uHfaI=
 github.com/grpc-ecosystem/go-grpc-middleware v1.4.0/go.mod h1:g5qyo/la0ALbONm6Vbp88Yd8NsDy6rZz+RcrMPxvld8=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 h1:Ovs26xHkKqVztRpIrF/92BcuyuQ/YW4NSIpoGtfXNho=
@@ -432,7 +419,6 @@ github.com/hashicorp/golang-lru v1.0.2 h1:dV3g9Z/unq5DpblPpw+Oqcv4dU/1omnb4Ok8iP
 github.com/hashicorp/golang-lru v1.0.2/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
-github.com/hashicorp/hcl v0.0.0-20170914154624-68e816d1c783/go.mod h1:oZtUIOe8dh44I2q6ScRibXws4Ajl+d+nod3AaR9vL5w=
 github.com/hashicorp/hcl v1.0.1-vault-7 h1:ag5OxFVy3QYTFTJODRzTKVZ6xvdfLLCA1cy/Y6xGI0I=
 github.com/hashicorp/hcl v1.0.1-vault-7/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
 github.com/hashicorp/memberlist v0.6.0 h1:hhVDLQUzWkLaitLLSrxLLqSD2l2+qiOz1DMr5zb9EQQ=
@@ -449,7 +435,6 @@ github.com/in-toto/attestation v1.2.0 h1:aPRUZ3azbqD7yEBD5fP3TD8Dszf+YHo284SOcpa
 github.com/in-toto/attestation v1.2.0/go.mod h1:r79G45gOmzPismgObLSL+rZTFxUgZLOQJI6LofTZgXk=
 github.com/in-toto/in-toto-golang v0.11.0 h1:nfidMYBFx+E0lnmX5KUnN2Pdm8zdNKal1ayjJuzzRoA=
 github.com/in-toto/in-toto-golang v0.11.0/go.mod h1:u3PjTnwFKjp5a1YCcw8SJg0G+tMeKfVoWsWeFMDCMtw=
-github.com/inconshreveable/log15 v0.0.0-20170622235902-74a0988b5f80/go.mod h1:cOaXtrgN4ScfRrD9Bre7U1thNq5RtJ8ZoP4iXVGRj6o=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/intel/goresctrl v0.12.0 h1:F44m7jiVgOdqWfTTWaREF+5HTeX3i06qhvpuzpnrBko=
@@ -479,7 +464,6 @@ github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxv
 github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
@@ -491,9 +475,6 @@ github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+
 github.com/letsencrypt/boulder v0.20260309.0 h1:kZynrxK3QfqLGx6hhoz+Rfs3hgltJs1p9Mp+4+VwnY0=
 github.com/letsencrypt/boulder v0.20260309.0/go.mod h1:yG8lj8pNPZ8taq3oNdTpfBS+eC74IaEuiewqzVpXiWE=
 github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/magiconair/properties v1.7.4-0.20170902060319-8d7837e64d3c/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
-github.com/mattn/go-colorable v0.0.10-0.20170816031813-ad5389df28cd/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
-github.com/mattn/go-isatty v0.0.2/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/g=
@@ -510,7 +491,6 @@ github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa1
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/mapstructure v0.0.0-20170523030023-d0303fe80992/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
@@ -602,7 +582,6 @@ github.com/package-url/packageurl-go v0.1.1/go.mod h1:uQd4a7Rh3ZsVg5j0lNyAfyxIeG
 github.com/pascaldekloe/goe v0.1.0 h1:cBOtyMzM9HTpWjXfbbunk26uA6nG3a8n06Wieeh0MwY=
 github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30/go.mod h1:85jBQOZwpVEaDAr341tbn15RS4fCAsIst0qp7i8ex1o=
-github.com/pelletier/go-toml v1.0.1-0.20170904195809-1d6b12b7cb29/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
 github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
 github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/pelletier/go-toml/v2 v2.4.3 h1:GTRvJQutkOSftxIFD5xw9aepkYNuPWmVJpffdDPYVpY=
@@ -691,16 +670,11 @@ github.com/sirupsen/logrus v1.10.2 h1:G2SED73/qrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBB
 github.com/sirupsen/logrus v1.10.2/go.mod h1:SLEg8TqYulVKKfIGHldVp2K2aYz2DKSVBq4g/H5bR7Q=
 github.com/spdx/tools-golang v0.5.7 h1:+sWcKGnhwp3vLdMqPcLdA6QK679vd86cK9hQWH3AwCg=
 github.com/spdx/tools-golang v0.5.7/go.mod h1:jg7w0LOpoNAw6OxKEzCoqPC2GCTj45LyTlVmXubDsYw=
-github.com/spf13/afero v0.0.0-20170901052352-ee1bd8ee15a1/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
-github.com/spf13/cast v1.1.0/go.mod h1:r2rcYCSwa1IExKTDiTfzaxqT2FNHs8hODu4LnUfgKEg=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
 github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
-github.com/spf13/jwalterweatherman v0.0.0-20170901151539-12bd96e66386/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
-github.com/spf13/pflag v1.0.1-0.20170901120850-7aff26db30c1/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/viper v1.0.0/go.mod h1:A8kyI5cUJhb8N+3pkfONlcEcZbueH6nhAm0Fq7SrnBM=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
@@ -872,7 +846,6 @@ golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=
 golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -887,10 +860,8 @@ golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
 golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
 golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
-golang.org/x/oauth2 v0.0.0-20170912212905-13449ad91cb2/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
-golang.org/x/sync v0.0.0-20170517211232-f52d1811a629/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -930,7 +901,6 @@ golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
 golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
 golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
@@ -938,7 +908,6 @@ golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
 golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
-golang.org/x/time v0.0.0-20170424234030-8be79e1e0910/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -955,18 +924,14 @@ golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/api v0.0.0-20170921000349-586095a6e407/go.mod h1:4mhQ8q/RsB7i+udVvVy5NUi08OU8ZlA0gRVgrF7VFY0=
 google.golang.org/api v0.287.1 h1:LiyJx32VU3cwQfLchn/513qKhc25hq0pEANYJoWNnnI=
 google.golang.org/api v0.287.1/go.mod h1:lM2kYRzYUCBY91P9h6VF1PYmvhxii3O5hji37qRvIcY=
-google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/genproto v0.0.0-20170918111702-1e559d0a00ee/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20260825221802-da73d73af1c5 h1:jPP56YzdY899KJ5W7efXHt/CkjlVfAaoFOwdi/IEAFA=
 google.golang.org/genproto v0.0.0-20260825221802-da73d73af1c5/go.mod h1:gutZdP0DwAHp4vu5WaXgEK7tjsJ77ZEqzlOFWGZGziE=
 google.golang.org/genproto/googleapis/api v0.0.0-20260825221802-da73d73af1c5 h1:izFU9hz7aeLI/Mi1J0991ae+xcwRLr7hTqWnB/9aIIU=
 google.golang.org/genproto/googleapis/api v0.0.0-20260825221802-da73d73af1c5/go.mod h1:3LhxRw4YYkf+ylAfgaY9JlVLFKhokkCV8duhLLe7+t0=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5 h1:1VUiZAXyC+zmiFYi+WLtBzr68Cj8wOofHjjrA/kkizc=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA=
-google.golang.org/grpc v1.2.1-0.20170921194603-d4b75ebd4f9f/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
 google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
 google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
diff --git a/vendor/github.com/golang/gddo/httputil/buster.go b/vendor/github.com/golang/gddo/httputil/buster.go
deleted file mode 100644
index beab151a4b..0000000000
--- a/vendor/github.com/golang/gddo/httputil/buster.go
+++ /dev/null
@@ -1,95 +0,0 @@
-// Copyright 2013 The Go Authors. All rights reserved.
-//
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file or at
-// https://developers.google.com/open-source/licenses/bsd.
-
-package httputil
-
-import (
-	"io"
-	"io/ioutil"
-	"net/http"
-	"net/url"
-	"strings"
-	"sync"
-)
-
-type busterWriter struct {
-	headerMap http.Header
-	status    int
-	io.Writer
-}
-
-func (bw *busterWriter) Header() http.Header {
-	return bw.headerMap
-}
-
-func (bw *busterWriter) WriteHeader(status int) {
-	bw.status = status
-}
-
-// CacheBusters maintains a cache of cache busting tokens for static resources served by Handler.
-type CacheBusters struct {
-	Handler http.Handler
-
-	mu     sync.Mutex
-	tokens map[string]string
-}
-
-func sanitizeTokenRune(r rune) rune {
-	if r <= ' ' || r >= 127 {
-		return -1
-	}
-	// Convert percent encoding reserved characters to '-'.
-	if strings.ContainsRune("!#$&'()*+,/:;=?@[]", r) {
-		return '-'
-	}
-	return r
-}
-
-// Get returns the cache busting token for path. If the token is not already
-// cached, Get issues a HEAD request on handler and uses the response ETag and
-// Last-Modified headers to compute a token.
-func (cb *CacheBusters) Get(path string) string {
-	cb.mu.Lock()
-	if cb.tokens == nil {
-		cb.tokens = make(map[string]string)
-	}
-	token, ok := cb.tokens[path]
-	cb.mu.Unlock()
-	if ok {
-		return token
-	}
-
-	w := busterWriter{
-		Writer:    ioutil.Discard,
-		headerMap: make(http.Header),
-	}
-	r := &http.Request{URL: &url.URL{Path: path}, Method: "HEAD"}
-	cb.Handler.ServeHTTP(&w, r)
-
-	if w.status == 200 {
-		token = w.headerMap.Get("Etag")
-		if token == "" {
-			token = w.headerMap.Get("Last-Modified")
-		}
-		token = strings.Trim(token, `" `)
-		token = strings.Map(sanitizeTokenRune, token)
-	}
-
-	cb.mu.Lock()
-	cb.tokens[path] = token
-	cb.mu.Unlock()
-
-	return token
-}
-
-// AppendQueryParam appends the token as a query parameter to path.
-func (cb *CacheBusters) AppendQueryParam(path string, name string) string {
-	token := cb.Get(path)
-	if token == "" {
-		return path
-	}
-	return path + "?" + name + "=" + token
-}
diff --git a/vendor/github.com/golang/gddo/httputil/httputil.go b/vendor/github.com/golang/gddo/httputil/httputil.go
deleted file mode 100644
index a03717c073..0000000000
--- a/vendor/github.com/golang/gddo/httputil/httputil.go
+++ /dev/null
@@ -1,25 +0,0 @@
-// Copyright 2013 The Go Authors. All rights reserved.
-//
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file or at
-// https://developers.google.com/open-source/licenses/bsd.
-
-// Package httputil is a toolkit for the Go net/http package.
-package httputil
-
-import (
-	"net"
-	"net/http"
-)
-
-// StripPort removes the port specification from an address.
-func StripPort(s string) string {
-	if h, _, err := net.SplitHostPort(s); err == nil {
-		s = h
-	}
-	return s
-}
-
-// Error defines a type for a function that accepts a ResponseWriter for
-// a Request with the HTTP status code and error.
-type Error func(w http.ResponseWriter, r *http.Request, status int, err error)
diff --git a/vendor/github.com/golang/gddo/httputil/respbuf.go b/vendor/github.com/golang/gddo/httputil/respbuf.go
deleted file mode 100644
index 051af2114b..0000000000
--- a/vendor/github.com/golang/gddo/httputil/respbuf.go
+++ /dev/null
@@ -1,58 +0,0 @@
-// Copyright 2013 The Go Authors. All rights reserved.
-//
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file or at
-// https://developers.google.com/open-source/licenses/bsd.
-
-package httputil
-
-import (
-	"bytes"
-	"net/http"
-	"strconv"
-)
-
-// ResponseBuffer is the current response being composed by its owner.
-// It implements http.ResponseWriter and io.WriterTo.
-type ResponseBuffer struct {
-	buf    bytes.Buffer
-	status int
-	header http.Header
-}
-
-// Write implements the http.ResponseWriter interface.
-func (rb *ResponseBuffer) Write(p []byte) (int, error) {
-	return rb.buf.Write(p)
-}
-
-// WriteHeader implements the http.ResponseWriter interface.
-func (rb *ResponseBuffer) WriteHeader(status int) {
-	rb.status = status
-}
-
-// Header implements the http.ResponseWriter interface.
-func (rb *ResponseBuffer) Header() http.Header {
-	if rb.header == nil {
-		rb.header = make(http.Header)
-	}
-	return rb.header
-}
-
-// WriteTo implements the io.WriterTo interface.
-func (rb *ResponseBuffer) WriteTo(w http.ResponseWriter) error {
-	for k, v := range rb.header {
-		w.Header()[k] = v
-	}
-	if rb.buf.Len() > 0 {
-		w.Header().Set("Content-Length", strconv.Itoa(rb.buf.Len()))
-	}
-	if rb.status != 0 {
-		w.WriteHeader(rb.status)
-	}
-	if rb.buf.Len() > 0 {
-		if _, err := w.Write(rb.buf.Bytes()); err != nil {
-			return err
-		}
-	}
-	return nil
-}
diff --git a/vendor/github.com/golang/gddo/httputil/static.go b/vendor/github.com/golang/gddo/httputil/static.go
deleted file mode 100644
index 6610dde0da..0000000000
--- a/vendor/github.com/golang/gddo/httputil/static.go
+++ /dev/null
@@ -1,265 +0,0 @@
-// Copyright 2013 The Go Authors. All rights reserved.
-//
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file or at
-// https://developers.google.com/open-source/licenses/bsd.
-
-package httputil
-
-import (
-	"bytes"
-	"crypto/sha1"
-	"errors"
-	"fmt"
-	"github.com/golang/gddo/httputil/header"
-	"io"
-	"io/ioutil"
-	"mime"
-	"net/http"
-	"os"
-	"path"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"sync"
-	"time"
-)
-
-// StaticServer serves static files.
-type StaticServer struct {
-	// Dir specifies the location of the directory containing the files to serve.
-	Dir string
-
-	// MaxAge specifies the maximum age for the cache control and expiration
-	// headers.
-	MaxAge time.Duration
-
-	// Error specifies the function used to generate error responses. If Error
-	// is nil, then http.Error is used to generate error responses.
-	Error Error
-
-	// MIMETypes is a map from file extensions to MIME types.
-	MIMETypes map[string]string
-
-	mu    sync.Mutex
-	etags map[string]string
-}
-
-func (ss *StaticServer) resolve(fname string) string {
-	if path.IsAbs(fname) {
-		panic("Absolute path not allowed when creating a StaticServer handler")
-	}
-	dir := ss.Dir
-	if dir == "" {
-		dir = "."
-	}
-	fname = filepath.FromSlash(fname)
-	return filepath.Join(dir, fname)
-}
-
-func (ss *StaticServer) mimeType(fname string) string {
-	ext := path.Ext(fname)
-	var mimeType string
-	if ss.MIMETypes != nil {
-		mimeType = ss.MIMETypes[ext]
-	}
-	if mimeType == "" {
-		mimeType = mime.TypeByExtension(ext)
-	}
-	if mimeType == "" {
-		mimeType = "application/octet-stream"
-	}
-	return mimeType
-}
-
-func (ss *StaticServer) openFile(fname string) (io.ReadCloser, int64, string, error) {
-	f, err := os.Open(fname)
-	if err != nil {
-		return nil, 0, "", err
-	}
-	fi, err := f.Stat()
-	if err != nil {
-		f.Close()
-		return nil, 0, "", err
-	}
-	const modeType = os.ModeDir | os.ModeSymlink | os.ModeNamedPipe | os.ModeSocket | os.ModeDevice
-	if fi.Mode()&modeType != 0 {
-		f.Close()
-		return nil, 0, "", errors.New("not a regular file")
-	}
-	return f, fi.Size(), ss.mimeType(fname), nil
-}
-
-// FileHandler returns a handler that serves a single file. The file is
-// specified by a slash separated path relative to the static server's Dir
-// field.
-func (ss *StaticServer) FileHandler(fileName string) http.Handler {
-	id := fileName
-	fileName = ss.resolve(fileName)
-	return &staticHandler{
-		ss:   ss,
-		id:   func(_ string) string { return id },
-		open: func(_ string) (io.ReadCloser, int64, string, error) { return ss.openFile(fileName) },
-	}
-}
-
-// DirectoryHandler returns a handler that serves files from a directory tree.
-// The directory is specified by a slash separated path relative to the static
-// server's Dir field.
-func (ss *StaticServer) DirectoryHandler(prefix, dirName string) http.Handler {
-	if !strings.HasSuffix(prefix, "/") {
-		prefix += "/"
-	}
-	idBase := dirName
-	dirName = ss.resolve(dirName)
-	return &staticHandler{
-		ss: ss,
-		id: func(p string) string {
-			if !strings.HasPrefix(p, prefix) {
-				return "."
-			}
-			return path.Join(idBase, p[len(prefix):])
-		},
-		open: func(p string) (io.ReadCloser, int64, string, error) {
-			if !strings.HasPrefix(p, prefix) {
-				return nil, 0, "", errors.New("request url does not match directory prefix")
-			}
-			p = p[len(prefix):]
-			return ss.openFile(filepath.Join(dirName, filepath.FromSlash(p)))
-		},
-	}
-}
-
-// FilesHandler returns a handler that serves the concatentation of the
-// specified files. The files are specified by slash separated paths relative
-// to the static server's Dir field.
-func (ss *StaticServer) FilesHandler(fileNames ...string) http.Handler {
-
-	// todo: cache concatenated files on disk and serve from there.
-
-	mimeType := ss.mimeType(fileNames[0])
-	var buf []byte
-	var openErr error
-
-	for _, fileName := range fileNames {
-		p, err := ioutil.ReadFile(ss.resolve(fileName))
-		if err != nil {
-			openErr = err
-			buf = nil
-			break
-		}
-		buf = append(buf, p...)
-	}
-
-	id := strings.Join(fileNames, " ")
-
-	return &staticHandler{
-		ss: ss,
-		id: func(_ string) string { return id },
-		open: func(p string) (io.ReadCloser, int64, string, error) {
-			return ioutil.NopCloser(bytes.NewReader(buf)), int64(len(buf)), mimeType, openErr
-		},
-	}
-}
-
-type staticHandler struct {
-	id   func(fname string) string
-	open func(p string) (io.ReadCloser, int64, string, error)
-	ss   *StaticServer
-}
-
-func (h *staticHandler) error(w http.ResponseWriter, r *http.Request, status int, err error) {
-	http.Error(w, http.StatusText(status), status)
-}
-
-func (h *staticHandler) etag(p string) (string, error) {
-	id := h.id(p)
-
-	h.ss.mu.Lock()
-	if h.ss.etags == nil {
-		h.ss.etags = make(map[string]string)
-	}
-	etag := h.ss.etags[id]
-	h.ss.mu.Unlock()
-
-	if etag != "" {
-		return etag, nil
-	}
-
-	// todo: if a concurrent goroutine is calculating the hash, then wait for
-	// it instead of computing it again here.
-
-	rc, _, _, err := h.open(p)
-	if err != nil {
-		return "", err
-	}
-
-	defer rc.Close()
-
-	w := sha1.New()
-	_, err = io.Copy(w, rc)
-	if err != nil {
-		return "", err
-	}
-
-	etag = fmt.Sprintf(`"%x"`, w.Sum(nil))
-
-	h.ss.mu.Lock()
-	h.ss.etags[id] = etag
-	h.ss.mu.Unlock()
-
-	return etag, nil
-}
-
-func (h *staticHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	p := path.Clean(r.URL.Path)
-	if p != r.URL.Path {
-		http.Redirect(w, r, p, 301)
-		return
-	}
-
-	etag, err := h.etag(p)
-	if err != nil {
-		h.error(w, r, http.StatusNotFound, err)
-		return
-	}
-
-	maxAge := h.ss.MaxAge
-	if maxAge == 0 {
-		maxAge = 24 * time.Hour
-	}
-	if r.FormValue("v") != "" {
-		maxAge = 365 * 24 * time.Hour
-	}
-
-	cacheControl := fmt.Sprintf("public, max-age=%d", maxAge/time.Second)
-
-	for _, e := range header.ParseList(r.Header, "If-None-Match") {
-		if e == etag {
-			w.Header().Set("Cache-Control", cacheControl)
-			w.Header().Set("Etag", etag)
-			w.WriteHeader(http.StatusNotModified)
-			return
-		}
-	}
-
-	rc, cl, ct, err := h.open(p)
-	if err != nil {
-		h.error(w, r, http.StatusNotFound, err)
-		return
-	}
-	defer rc.Close()
-
-	w.Header().Set("Cache-Control", cacheControl)
-	w.Header().Set("Etag", etag)
-	if ct != "" {
-		w.Header().Set("Content-Type", ct)
-	}
-	if cl != 0 {
-		w.Header().Set("Content-Length", strconv.FormatInt(cl, 10))
-	}
-	w.WriteHeader(http.StatusOK)
-	if r.Method != "HEAD" {
-		io.Copy(w, rc)
-	}
-}
diff --git a/vendor/github.com/golang/gddo/httputil/transport.go b/vendor/github.com/golang/gddo/httputil/transport.go
deleted file mode 100644
index fdad3b4780..0000000000
--- a/vendor/github.com/golang/gddo/httputil/transport.go
+++ /dev/null
@@ -1,87 +0,0 @@
-// Copyright 2015 The Go Authors. All rights reserved.
-//
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file or at
-// https://developers.google.com/open-source/licenses/bsd.
-
-// This file implements a http.RoundTripper that authenticates
-// requests issued against api.github.com endpoint.
-
-package httputil
-
-import (
-	"net/http"
-	"net/url"
-)
-
-// AuthTransport is an implementation of http.RoundTripper that authenticates
-// with the GitHub API.
-//
-// When both a token and client credentials are set, the latter is preferred.
-type AuthTransport struct {
-	UserAgent          string
-	GithubToken        string
-	GithubClientID     string
-	GithubClientSecret string
-	Base               http.RoundTripper
-}
-
-// RoundTrip implements the http.RoundTripper interface.
-func (t *AuthTransport) RoundTrip(req *http.Request) (*http.Response, error) {
-	var reqCopy *http.Request
-	if t.UserAgent != "" {
-		reqCopy = copyRequest(req)
-		reqCopy.Header.Set("User-Agent", t.UserAgent)
-	}
-	if req.URL.Host == "api.github.com" && req.URL.Scheme == "https" {
-		switch {
-		case t.GithubClientID != "" && t.GithubClientSecret != "":
-			if reqCopy == nil {
-				reqCopy = copyRequest(req)
-			}
-			if reqCopy.URL.RawQuery == "" {
-				reqCopy.URL.RawQuery = "client_id=" + t.GithubClientID + "&client_secret=" + t.GithubClientSecret
-			} else {
-				reqCopy.URL.RawQuery += "&client_id=" + t.GithubClientID + "&client_secret=" + t.GithubClientSecret
-			}
-		case t.GithubToken != "":
-			if reqCopy == nil {
-				reqCopy = copyRequest(req)
-			}
-			reqCopy.Header.Set("Authorization", "token "+t.GithubToken)
-		}
-	}
-	if reqCopy != nil {
-		return t.base().RoundTrip(reqCopy)
-	}
-	return t.base().RoundTrip(req)
-}
-
-// CancelRequest cancels an in-flight request by closing its connection.
-func (t *AuthTransport) CancelRequest(req *http.Request) {
-	type canceler interface {
-		CancelRequest(req *http.Request)
-	}
-	if cr, ok := t.base().(canceler); ok {
-		cr.CancelRequest(req)
-	}
-}
-
-func (t *AuthTransport) base() http.RoundTripper {
-	if t.Base != nil {
-		return t.Base
-	}
-	return http.DefaultTransport
-}
-
-func copyRequest(req *http.Request) *http.Request {
-	req2 := new(http.Request)
-	*req2 = *req
-	req2.URL = new(url.URL)
-	*req2.URL = *req.URL
-	req2.Header = make(http.Header, len(req.Header))
-	for k, s := range req.Header {
-		req2.Header[k] = append([]string(nil), s...)
-	}
-	return req2
-}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 52058974e7..b09b664fd3 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -874,10 +874,6 @@ github.com/gohugoio/hashstructure
 # github.com/golang-jwt/jwt/v5 v5.3.1
 ## explicit; go 1.21
 github.com/golang-jwt/jwt/v5
-# github.com/golang/gddo v0.0.0-20210115222349-20d68f94ee1f
-## explicit; go 1.13
-github.com/golang/gddo/httputil
-github.com/golang/gddo/httputil/header
 # github.com/golang/protobuf v1.5.4
 ## explicit; go 1.17
 github.com/golang/protobuf/proto