Pull request 2471: Update Go & tools

Squashed commit of the following: commit 7bb21d6e92f1bdb3f928c644f6ea4adda41e1ace Author: Eugene Burkov <E.Burkov@AdGuard.COM> Date: Thu Sep 4 19:07:35 2025 +0300 all: imp code commit 85a8751ba41e82b9e92a32d103de719ecc385ff4 Author: Eugene Burkov <E.Burkov@AdGuard.COM> Date: Thu Sep 4 17:59:04 2025 +0300 all: upd go & tools
2025-12-20 01:11:03 +08:00 · 2025-09-04 19:21:53 +03:00
parent f364a9f851
commit d2fa4f1af9
28 changed files with 228 additions and 242 deletions
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,7 +1,7 @@
 'name': 'build'

 'env':
-  'GO_VERSION': '1.24.6'
+  'GO_VERSION': '1.25.1'
  'NODE_VERSION': '20'

 'on':
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -1,7 +1,7 @@
 'name': 'lint'

 'env':
-  'GO_VERSION': '1.24.6'
+  'GO_VERSION': '1.25.1'

 'on':
  'push':
--- a/.gitignore
+++ b/.gitignore
@@ -37,7 +37,6 @@ AdGuardHome.exe
 AdGuardHome.yaml*
 coverage.txt
 node_modules/
-test-reports/
 tmp/

 !/build/gitkeep
--- a/.markdownlint.json
+++ b/.markdownlint.json
@@ -21,5 +21,6 @@
  },
  "line-length": false,
  "no-bare-urls": false,
+  "no-emphasis-as-heading": false,
  "link-fragments": false
 }
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,6 +18,10 @@ See also the [v0.107.66 GitHub milestone][ms-v0.107.66].
 NOTE: Add new changes BELOW THIS COMMENT.
 -->

+### Security
+
+- Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in [1.25.1][go-1.25.1].
+
 ### Changed

 - Our snap package now uses the `core24` image as its base.
@@ -33,6 +37,8 @@ NOTE: Add new changes BELOW THIS COMMENT.
 [#7985]: https://github.com/AdguardTeam/AdGuardHome/issues/7985
 [#7987]: https://github.com/AdguardTeam/AdGuardHome/issues/7987

+[go-1.25.1]: https://groups.google.com/g/golang-announce/c/PtW9VW21NPs
+
 <!--
 NOTE: Add new changes ABOVE THIS COMMENT.
 -->
--- a/80
+++ b/80
@@ -1,20 +1,18 @@
-# Keep the Makefile POSIX-compliant.  We currently allow hyphens in
-# target names, but that may change in the future.
+# Keep the Makefile POSIX-compliant.  We currently allow hyphens in target
+# names, but that may change in the future.
 #
 # See https://pubs.opengroup.org/onlinepubs/9799919799/utilities/make.html.
 .POSIX:

-# This comment is used to simplify checking local copies of the
-# Makefile.  Bump this number every time a significant change is made to
-# this Makefile.
+# This comment is used to simplify checking local copies of the Makefile.  Bump
+# this number every time a significant change is made to this Makefile.
 #
-# AdGuard-Project-Version: 9
+# AdGuard-Project-Version: 10

-# Don't name these macros "GO" etc., because GNU Make apparently makes
-# them exported environment variables with the literal value of
-# "${GO:-go}" and so on, which is not what we need.  Use a dot in the
-# name to make sure that users don't have an environment variable with
-# the same name.
+# Don't name these macros "GO" etc., because GNU Make apparently makes them
+# exported environment variables with the literal value of "${GO:-go}" and so
+# on, which is not what we need.  Use a dot in the name to make sure that users
+# don't have an environment variable with the same name.
 #
 # See https://unix.stackexchange.com/q/646255/105635.
 GO.MACRO = $${GO:-go}
@@ -27,7 +25,7 @@ DIST_DIR = dist
 GOAMD64 = v1
 GOPROXY = https://proxy.golang.org|direct
 GOTELEMETRY = off
-GOTOOLCHAIN = go1.24.6
+GOTOOLCHAIN = go1.25.1
 GPG_KEY = devteam@adguard.com
 GPG_KEY_PASSPHRASE = not-a-real-password
 NPM = npm
@@ -41,17 +39,15 @@ VERSION = v0.0.0

 NEXTAPI = 0

-# Macros for the build-release target.  If FRONTEND_PREBUILT is 0, the
-# default, the macro $(BUILD_RELEASE_DEPS_$(FRONTEND_PREBUILT)) expands
-# into BUILD_RELEASE_DEPS_0, and so both frontend and backend
-# dependencies are fetched and the frontend is built.  Otherwise, if
-# FRONTEND_PREBUILT is 1, only backend dependencies are fetched and the
-# frontend isn't rebuilt.
+# Macros for the build-release target.  If FRONTEND_PREBUILT is 0, the default,
+# the macro $(BUILD_RELEASE_DEPS_$(FRONTEND_PREBUILT)) expands into
+# BUILD_RELEASE_DEPS_0, and so both frontend and backend dependencies are
+# fetched and the frontend is built.  Otherwise, if FRONTEND_PREBUILT is 1, only
+# backend dependencies are fetched and the frontend isn't rebuilt.
 #
-# TODO(a.garipov): We could probably do that from .../build-release.sh,
-# but that would mean either calling make from inside make or
-# duplicating commands in two places, both of which don't seem to me
-# like nice solutions.
+# TODO(a.garipov): We could probably do that from .../build-release.sh, but that
+# would mean either calling make from inside make or duplicating commands in two
+# places, both of which don't seem to me like nice solutions.
 FRONTEND_PREBUILT = 0
 BUILD_RELEASE_DEPS_0 = deps js-build
 BUILD_RELEASE_DEPS_1 = go-deps
@@ -84,25 +80,31 @@ ENV_MISC = env\

 # Keep the line above blank.

-# Keep this target first, so that a naked make invocation triggers a
-# full build.
+# Keep this target first, so that a naked make invocation triggers a full build.
+.PHONY: build
 build: deps quick-build

+.PHONY: init
 init: ; git config core.hooksPath ./scripts/hooks

+.PHONY: quick-build
 quick-build: js-build go-build

+.PHONY: deps lint test
 deps: js-deps go-deps
 lint: js-lint go-lint
 test: js-test go-test

-# Here and below, keep $(SHELL) in quotes, because on Windows this will
-# expand to something like "C:/Program Files/Git/usr/bin/sh.exe".
+# Here and below, keep $(SHELL) in quotes, because on Windows this will expand
+# to something like "C:/Program Files/Git/usr/bin/sh.exe".
+.PHONY: build-docker
 build-docker: ; $(ENV) "$(SHELL)" ./scripts/make/build-docker.sh

+.PHONY: build-release
 build-release: $(BUILD_RELEASE_DEPS_$(FRONTEND_PREBUILT))
 	$(ENV) "$(SHELL)" ./scripts/make/build-release.sh

+.PHONY: js-build js-deps js-typecheck js-lint js-test js-test-e2e
 js-build:     ; $(NPM) $(NPM_FLAGS) run build-prod
 js-deps:      ; $(NPM) $(NPM_INSTALL_FLAGS) ci
 js-typecheck: ; $(NPM) $(NPM_FLAGS) run typecheck
@@ -110,22 +112,24 @@ js-lint:      ; $(NPM) $(NPM_FLAGS) run lint
 js-test:      ; $(NPM) $(NPM_FLAGS) run test
 js-test-e2e:  ; $(NPM) $(NPM_FLAGS) run test:e2e

-go-bench:     ; $(ENV) "$(SHELL)"    ./scripts/make/go-bench.sh
-go-build:     ; $(ENV) "$(SHELL)"    ./scripts/make/go-build.sh
-go-deps:      ; $(ENV) "$(SHELL)"    ./scripts/make/go-deps.sh
-go-env:       ; $(ENV) "$(GO.MACRO)" env
-go-fuzz:      ; $(ENV) "$(SHELL)"    ./scripts/make/go-fuzz.sh
-go-lint:      ; $(ENV) "$(SHELL)"    ./scripts/make/go-lint.sh
-# TODO(a.garipov): Think about making RACE='1' the default for all
-# targets.
-go-test:      ; $(ENV) RACE='1' "$(SHELL)" ./scripts/make/go-test.sh
-go-tools:     ; $(ENV)          "$(SHELL)" ./scripts/make/go-tools.sh
-go-upd-tools: ; $(ENV)          "$(SHELL)" ./scripts/make/go-upd-tools.sh
+# TODO(a.garipov): Think about making RACE='1' the default for all targets.
+.PHONY: go-bench go-build go-deps go-env go-fuzz go-lint go-test go-tools go-upd-tools
+go-bench:     ; $(ENV)          "$(SHELL)"    ./scripts/make/go-bench.sh
+go-build:     ; $(ENV)          "$(SHELL)"    ./scripts/make/go-build.sh
+go-deps:      ; $(ENV)          "$(SHELL)"    ./scripts/make/go-deps.sh
+go-env:       ; $(ENV)          "$(GO.MACRO)" env
+go-fuzz:      ; $(ENV)          "$(SHELL)"    ./scripts/make/go-fuzz.sh
+go-lint:      ; $(ENV)          "$(SHELL)"    ./scripts/make/go-lint.sh
+go-test:      ; $(ENV) RACE='1' "$(SHELL)"    ./scripts/make/go-test.sh
+go-tools:     ; $(ENV)          "$(SHELL)"    ./scripts/make/go-tools.sh
+go-upd-tools: ; $(ENV)          "$(SHELL)"    ./scripts/make/go-upd-tools.sh

+.PHONY: go-check
 go-check: go-tools go-lint go-test

 # A quick check to make sure that all operating systems relevant to the
 # development of the project can be typechecked and built successfully.
+.PHONY: go-os-check
 go-os-check:
 	$(ENV) GOOS='darwin'  "$(GO.MACRO)" vet ./internal/...
 	$(ENV) GOOS='freebsd' "$(GO.MACRO)" vet ./internal/...
@@ -133,8 +137,10 @@ go-os-check:
 	$(ENV) GOOS='linux'   "$(GO.MACRO)" vet ./internal/...
 	$(ENV) GOOS='windows' "$(GO.MACRO)" vet ./internal/...

+.PHONY: txt-lint
 txt-lint: ; $(ENV) "$(SHELL)" ./scripts/make/txt-lint.sh

+.PHONY: md-lint sh-lint
 md-lint:  ; $(ENV_MISC) "$(SHELL)" ./scripts/make/md-lint.sh
 sh-lint:  ; $(ENV_MISC) "$(SHELL)" ./scripts/make/sh-lint.sh

--- a/README.md
+++ b/README.md
@@ -205,7 +205,7 @@ Run `make init` to prepare the development environment.

 You will need this to build AdGuard Home:

- [Go](https://golang.org/dl/) v1.24 or later;
+- [Go](https://golang.org/dl/) v1.25 or later;
 - [Node.js](https://nodejs.org/en/download/) v20.19 or later;
 - [npm](https://www.npmjs.com/) v10.8 or later;

--- a/bamboo-specs/release.yaml
+++ b/bamboo-specs/release.yaml
@@ -8,7 +8,7 @@
 'variables':
    'channel': 'edge'
    'dockerFrontend': 'adguard/home-js-builder:3.1'
-    'dockerGo': 'adguard/go-builder:1.24.6--1'
+    'dockerGo': 'adguard/go-builder:1.25.1--1'

 'stages':
  - 'Build frontend':
@@ -279,7 +279,7 @@
        'variables':
            'channel': 'beta'
            'dockerFrontend': 'adguard/home-js-builder:3.1'
-            'dockerGo': 'adguard/go-builder:1.24.6--1'
+            'dockerGo': 'adguard/go-builder:1.25.1--1'
    # release-vX.Y.Z branches are the branches from which the actual final
    # release is built.
  - '^release-v[0-9]+\.[0-9]+\.[0-9]+':
@@ -295,4 +295,4 @@
        'variables':
            'channel': 'release'
            'dockerFrontend': 'adguard/home-js-builder:3.1'
-            'dockerGo': 'adguard/go-builder:1.24.6--1'
+            'dockerGo': 'adguard/go-builder:1.25.1--1'
--- a/bamboo-specs/test.yaml
+++ b/bamboo-specs/test.yaml
@@ -6,7 +6,7 @@
    'name': 'AdGuard Home - Build and run tests'
 'variables':
    'dockerFrontend': 'adguard/home-js-builder:3.1'
-    'dockerGo': 'adguard/go-builder:1.24.6--1'
+    'dockerGo': 'adguard/go-builder:1.25.1--1'
    'channel': 'development'

 'stages':
@@ -251,5 +251,5 @@
        # may need to build a few of these.
        'variables':
            'dockerFrontend': 'adguard/home-js-builder:3.1'
-            'dockerGo': 'adguard/go-builder:1.24.6--1'
+            'dockerGo': 'adguard/go-builder:1.25.1--1'
            'channel': 'candidate'
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/AdguardTeam/AdGuardHome

-go 1.24.6
+go 1.25.1

 require (
 	github.com/AdguardTeam/dnsproxy v0.76.1
@@ -30,7 +30,7 @@ require (
 	github.com/mdlayher/raw v0.1.0
 	github.com/miekg/dns v1.1.66
 	github.com/quic-go/quic-go v0.53.0
-	github.com/stretchr/testify v1.10.0
+	github.com/stretchr/testify v1.11.1
 	github.com/ti-mo/netfilter v0.5.3
 	go.etcd.io/bbolt v1.4.1
 	golang.org/x/crypto v0.41.0
@@ -43,9 +43,9 @@ require (
 )

 require (
-	cloud.google.com/go v0.121.5 // indirect
+	cloud.google.com/go v0.121.6 // indirect
 	cloud.google.com/go/ai v0.12.1 // indirect
-	cloud.google.com/go/auth v0.16.4 // indirect
+	cloud.google.com/go/auth v0.16.5 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.8.0 // indirect
 	cloud.google.com/go/longrunning v0.6.7 // indirect
@@ -63,8 +63,8 @@ require (
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
 	github.com/googleapis/gax-go/v2 v2.15.0 // indirect
-	github.com/gookit/color v1.5.4 // indirect
-	github.com/gordonklaus/ineffassign v0.1.0 // indirect
+	github.com/gookit/color v1.6.0 // indirect
+	github.com/gordonklaus/ineffassign v0.2.0 // indirect
 	github.com/josharian/native v1.1.0 // indirect
 	github.com/jstemmer/go-junit-report/v2 v2.1.0 // indirect
 	github.com/kisielk/errcheck v1.9.0 // indirect
@@ -81,35 +81,48 @@ require (
 	github.com/uudashr/gocognit v1.2.0 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.62.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0 // indirect
-	go.opentelemetry.io/otel v1.37.0 // indirect
-	go.opentelemetry.io/otel/metric v1.37.0 // indirect
-	go.opentelemetry.io/otel/trace v1.37.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
+	go.opentelemetry.io/otel v1.38.0 // indirect
+	go.opentelemetry.io/otel/metric v1.38.0 // indirect
+	go.opentelemetry.io/otel/trace v1.38.0 // indirect
 	go.uber.org/mock v0.5.2 // indirect
-	golang.org/x/exp/typeparams v0.0.0-20250813145105-42675adae3e6 // indirect
+	golang.org/x/exp/typeparams v0.0.0-20250819193227-8b4c13bb791b // indirect
 	golang.org/x/mod v0.27.0 // indirect
 	golang.org/x/oauth2 v0.30.0 // indirect
 	golang.org/x/sync v0.16.0 // indirect
-	golang.org/x/telemetry v0.0.0-20250813145757-41cd51e6ab6a // indirect
+	golang.org/x/telemetry v0.0.0-20250829165349-50b750f55de1 // indirect
 	golang.org/x/term v0.34.0 // indirect
 	golang.org/x/text v0.28.0 // indirect
 	golang.org/x/time v0.12.0 // indirect
 	golang.org/x/tools v0.36.0 // indirect
 	golang.org/x/vuln v1.1.4 // indirect
 	gonum.org/v1/gonum v0.16.0 // indirect
-	google.golang.org/api v0.247.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250811230008-5f3141c8851a // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a // indirect
-	google.golang.org/grpc v1.74.2 // indirect
-	google.golang.org/protobuf v1.36.7 // indirect
+	google.golang.org/api v0.248.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250826171959-ef028d996bc1 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250826171959-ef028d996bc1 // indirect
+	google.golang.org/grpc v1.75.0 // indirect
+	google.golang.org/protobuf v1.36.8 // indirect
 	honnef.co/go/tools v0.6.1 // indirect
 	mvdan.cc/editorconfig v0.3.0 // indirect
-	mvdan.cc/gofumpt v0.8.0 // indirect
+	mvdan.cc/gofumpt v0.9.0 // indirect
 	mvdan.cc/sh/v3 v3.12.0 // indirect
 	mvdan.cc/unparam v0.0.0-20250301125049-0df0534333a4 // indirect
 )

+// NOTE:  Keep in sync with .gitignore.
+ignore (
+	./agh-backup
+	./bin
+	./build
+	./client
+	./data
+	./dist
+	./test-reports
+	./tmp
+	node_modules
+)
+
 tool (
 	github.com/fzipp/gocyclo/cmd/gocyclo
 	github.com/golangci/misspell/cmd/misspell
--- a/go.sum
+++ b/go.sum
@@ -1,9 +1,9 @@
-cloud.google.com/go v0.121.5 h1:KU9tFP5NeZiVDSWcsgjJ2P/HosAlD4fCGBimBlGiNXA=
-cloud.google.com/go v0.121.5/go.mod h1:coChdst4Ea5vUpiALcYKXEpR1S9ZgXbhEzzMcMR66vI=
+cloud.google.com/go v0.121.6 h1:waZiuajrI28iAf40cWgycWNgaXPO06dupuS+sgibK6c=
+cloud.google.com/go v0.121.6/go.mod h1:coChdst4Ea5vUpiALcYKXEpR1S9ZgXbhEzzMcMR66vI=
 cloud.google.com/go/ai v0.12.1 h1:m1n/VjUuHS+pEO/2R4/VbuuEIkgk0w67fDQvFaMngM0=
 cloud.google.com/go/ai v0.12.1/go.mod h1:5vIPNe1ZQsVZqCliXIPL4QnhObQQY4d9hAGHdVc4iw4=
-cloud.google.com/go/auth v0.16.4 h1:fXOAIQmkApVvcIn7Pc2+5J8QTMVbUGLscnSVNl11su8=
-cloud.google.com/go/auth v0.16.4/go.mod h1:j10ncYwjX/g3cdX7GpEzsdM+d+ZNsXAbb6qXA7p1Y5M=
+cloud.google.com/go/auth v0.16.5 h1:mFWNQ2FEVWAliEQWpAdH80omXFokmrnbDhUS9cBywsI=
+cloud.google.com/go/auth v0.16.5/go.mod h1:utzRfHMP+Vv0mpOkTRQoWD2q3BatTOoWbA7gCc2dUhQ=
 cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/compute/metadata v0.8.0 h1:HxMRIbao8w17ZX6wBnjhcDkW6lTFpgcaobyVfZWqRLA=
@@ -87,10 +87,12 @@ github.com/googleapis/enterprise-certificate-proxy v0.3.6 h1:GW/XbdyBFQ8Qe+YAmFU
 github.com/googleapis/enterprise-certificate-proxy v0.3.6/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA=
 github.com/googleapis/gax-go/v2 v2.15.0 h1:SyjDc1mGgZU5LncH8gimWo9lW1DtIfPibOG81vgd/bo=
 github.com/googleapis/gax-go/v2 v2.15.0/go.mod h1:zVVkkxAQHa1RQpg9z2AUCMnKhi0Qld9rcmyfL1OZhoc=
-github.com/gookit/color v1.5.4 h1:FZmqs7XOyGgCAxmWyPslpiok1k05wmY3SJTytgvYFs0=
-github.com/gookit/color v1.5.4/go.mod h1:pZJOeOS8DM43rXbp4AZo1n9zCU2qjpcRko0b6/QJi9w=
-github.com/gordonklaus/ineffassign v0.1.0 h1:y2Gd/9I7MdY1oEIt+n+rowjBNDcLQq3RsH5hwJd0f9s=
-github.com/gordonklaus/ineffassign v0.1.0/go.mod h1:Qcp2HIAYhR7mNUVSIxZww3Guk4it82ghYcEXIAk+QT0=
+github.com/gookit/assert v0.1.1 h1:lh3GcawXe/p+cU7ESTZ5Ui3Sm/x8JWpIis4/1aF0mY0=
+github.com/gookit/assert v0.1.1/go.mod h1:jS5bmIVQZTIwk42uXl4lyj4iaaxx32tqH16CFj0VX2E=
+github.com/gookit/color v1.6.0 h1:JjJXBTk1ETNyqyilJhkTXJYYigHG24TM9Xa2M1xAhRA=
+github.com/gookit/color v1.6.0/go.mod h1:9ACFc7/1IpHGBW8RwuDm/0YEnhg3dwwXpoMsmtyHfjs=
+github.com/gordonklaus/ineffassign v0.2.0 h1:Uths4KnmwxNJNzq87fwQQDDnbNb7De00VOk9Nu0TySs=
+github.com/gordonklaus/ineffassign v0.2.0/go.mod h1:TIpymnagPSexySzs7F9FnO1XFTy8IT3a59vmZp5Y9Lw=
 github.com/hugelgupf/socketpair v0.0.0-20190730060125-05d35a94e714 h1:/jC7qQFrv8CrSJVmaolDVOxTfS9kc36uB6H40kdbQq8=
 github.com/hugelgupf/socketpair v0.0.0-20190730060125-05d35a94e714/go.mod h1:2Goc3h8EklBH5mspfHFxBnEoURQCGzQQH1ga9Myjvis=
 github.com/insomniacslk/dhcp v0.0.0-20250417080101-5f8cf70e8c5f h1:dd33oobuIv9PcBVqvbEiCXEbNTomOHyj3WFuC5YiPRU=
@@ -159,8 +161,8 @@ github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/ti-mo/netfilter v0.2.0/go.mod h1:8GbBGsY/8fxtyIdfwy29JiluNcPK4K7wIT+x42ipqUU=
 github.com/ti-mo/netfilter v0.5.3 h1:ikzduvnaUMwre5bhbNwWOd6bjqLMVb33vv0XXbK0xGQ=
 github.com/ti-mo/netfilter v0.5.3/go.mod h1:08SyBCg6hu1qyQk4s3DjjJKNrm3RTb32nm6AzyT972E=
@@ -174,31 +176,28 @@ github.com/uudashr/gocognit v1.2.0 h1:3BU9aMr1xbhPlvJLSydKwdLN3tEUUrzPSSM8S4hDYR
 github.com/uudashr/gocognit v1.2.0/go.mod h1:k/DdKPI6XBZO1q7HgoV2juESI2/Ofj9AcHPZhBBdrTU=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
-github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
 go.etcd.io/bbolt v1.4.1 h1:5mOV+HWjIPLEAlUGMsveaUvK2+byZMFOzojoi7bh7uI=
 go.etcd.io/bbolt v1.4.1/go.mod h1:c8zu2BnXWTu2XM4XcICtbGSl9cFwsXtcf9zLt2OncM8=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
 go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.62.0 h1:rbRJ8BBoVMsQShESYZ0FkvcITu8X8QNwJogcLUmDNNw=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.62.0/go.mod h1:ru6KHrNtNHxM4nD/vd6QrLVWgKhxPYgblq4VAtNawTQ=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0 h1:Hf9xI/XLML9ElpiHVDNwvqI0hIFlzV8dgIr35kV1kRU=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0/go.mod h1:NfchwuyNoMcZ5MLHwPrODwUF1HWCXWrL31s8gSAdIKY=
-go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
-go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
-go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
-go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
-go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
-go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg=
-go.opentelemetry.io/otel/sdk/metric v1.37.0 h1:90lI228XrB9jCMuSdA0673aubgRobVZFhbjxHHspCPc=
-go.opentelemetry.io/otel/sdk/metric v1.37.0/go.mod h1:cNen4ZWfiD37l5NhS+Keb5RXVWZWpRE+9WyVCpbo5ps=
-go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
-go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 h1:YH4g8lQroajqUwWbq/tr2QX1JFmEXaDLgG+ew9bLMWo=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0/go.mod h1:fvPi2qXDqFs8M4B4fmJhE92TyQs9Ydjlg3RvfUp+NbQ=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 h1:RbKq8BG0FI8OiXhBfcRtqqHcZcka+gU3cskNuf05R18=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0/go.mod h1:h06DGIukJOevXaj/xrNjhi/2098RZzcLTbc0jDAUbsg=
+go.opentelemetry.io/otel v1.38.0 h1:RkfdswUDRimDg0m2Az18RKOsnI8UDzppJAtj01/Ymk8=
+go.opentelemetry.io/otel v1.38.0/go.mod h1:zcmtmQ1+YmQM9wrNsTGV/q/uyusom3P8RxwExxkZhjM=
+go.opentelemetry.io/otel/metric v1.38.0 h1:Kl6lzIYGAh5M159u9NgiRkmoMKjvbsKtYRwgfrA6WpA=
+go.opentelemetry.io/otel/metric v1.38.0/go.mod h1:kB5n/QoRM8YwmUahxvI3bO34eVtQf2i4utNVLr9gEmI=
+go.opentelemetry.io/otel/sdk v1.38.0 h1:l48sr5YbNf2hpCUj/FoGhW9yDkl+Ma+LrVl8qaM5b+E=
+go.opentelemetry.io/otel/sdk v1.38.0/go.mod h1:ghmNdGlVemJI3+ZB5iDEuk4bWA3GkTpW+DOoZMYBVVg=
+go.opentelemetry.io/otel/sdk/metric v1.38.0 h1:aSH66iL0aZqo//xXzQLYozmWrXxyFkBJ6qT5wthqPoM=
+go.opentelemetry.io/otel/sdk/metric v1.38.0/go.mod h1:dg9PBnW9XdQ1Hd6ZnRz689CbtrUp0wMMs9iPcgT9EZA=
+go.opentelemetry.io/otel/trace v1.38.0 h1:Fxk5bKrDZJUH+AMyyIXGcFAPah0oRcT+LuNtJrmcNLE=
+go.opentelemetry.io/otel/trace v1.38.0/go.mod h1:j1P9ivuFsTceSWe1oY+EeW3sc+Pp42sO++GHkg4wwhs=
 go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
 go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
-go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
-go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=
 go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
@@ -207,11 +206,10 @@ golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
 golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
 golang.org/x/exp v0.0.0-20250813145105-42675adae3e6 h1:SbTAbRFnd5kjQXbczszQ0hdk3ctwYf3qBNH9jIsGclE=
 golang.org/x/exp v0.0.0-20250813145105-42675adae3e6/go.mod h1:4QTo5u+SEIbbKW1RacMZq1YEfOBqeXa19JeshGi+zc4=
-golang.org/x/exp/typeparams v0.0.0-20250813145105-42675adae3e6 h1:zAfbUfwhYzU4abt1UJxExk7WVbeTsYEnOPySl6RVucI=
-golang.org/x/exp/typeparams v0.0.0-20250813145105-42675adae3e6/go.mod h1:4Mzdyp/6jzw9auFDJ3OMF5qksa7UvPnzKqTVGcb04ms=
+golang.org/x/exp/typeparams v0.0.0-20250819193227-8b4c13bb791b h1:GU1ttDuJS89SePnuEsEuLj7dMMFP2JkGsDV1Z51iDXo=
+golang.org/x/exp/typeparams v0.0.0-20250819193227-8b4c13bb791b/go.mod h1:4Mzdyp/6jzw9auFDJ3OMF5qksa7UvPnzKqTVGcb04ms=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
 golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
@@ -220,7 +218,6 @@ golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc=
-golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
 golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
 golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
@@ -236,14 +233,12 @@ golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20201015000850-e3ed0017c211/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210315160823-c6e025ad8005/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
 golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/telemetry v0.0.0-20250813145757-41cd51e6ab6a h1:60aHXv7uIB0ngdMlalCWv6pSC/giLMowErJBA/5xbPQ=
-golang.org/x/telemetry v0.0.0-20250813145757-41cd51e6ab6a/go.mod h1:JIJwPkb04vX0KeIBbQ7epGtgIjA8ihHbsAtW4A/lIQ4=
+golang.org/x/telemetry v0.0.0-20250829165349-50b750f55de1 h1:zRLyLxwtVA3d2qsYvSJVSNco/qz2wzR8oJNhpLTN6x8=
+golang.org/x/telemetry v0.0.0-20250829165349-50b750f55de1/go.mod h1:JIJwPkb04vX0KeIBbQ7epGtgIjA8ihHbsAtW4A/lIQ4=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
 golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
@@ -254,9 +249,7 @@ golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
 golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
 golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
 golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
 golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM=
@@ -265,24 +258,22 @@ golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTF
 golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated/go.mod h1:RVAQXBGNv1ib0J382/DPCRS/BPnsGebyM1Gj5VSDpG8=
 golang.org/x/vuln v1.1.4 h1:Ju8QsuyhX3Hk8ma3CesTbO8vfJD9EvUBgHvkxHBzj0I=
 golang.org/x/vuln v1.1.4/go.mod h1:F+45wmU18ym/ca5PLTPLsSzr2KppzswxPP603ldA67s=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
 gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
-google.golang.org/api v0.247.0 h1:tSd/e0QrUlLsrwMKmkbQhYVa109qIintOls2Wh6bngc=
-google.golang.org/api v0.247.0/go.mod h1:r1qZOPmxXffXg6xS5uhx16Fa/UFY8QU/K4bfKrnvovM=
+google.golang.org/api v0.248.0 h1:hUotakSkcwGdYUqzCRc5yGYsg4wXxpkKlW5ryVqvC1Y=
+google.golang.org/api v0.248.0/go.mod h1:yAFUAF56Li7IuIQbTFoLwXTCI6XCFKueOlS7S9e4F9k=
 google.golang.org/genproto v0.0.0-20250603155806-513f23925822 h1:rHWScKit0gvAPuOnu87KpaYtjK5zBMLcULh7gxkCXu4=
 google.golang.org/genproto v0.0.0-20250603155806-513f23925822/go.mod h1:HubltRL7rMh0LfnQPkMH4NPDFEWp0jw3vixw7jEM53s=
-google.golang.org/genproto/googleapis/api v0.0.0-20250811230008-5f3141c8851a h1:DMCgtIAIQGZqJXMVzJF4MV8BlWoJh2ZuFiRdAleyr58=
-google.golang.org/genproto/googleapis/api v0.0.0-20250811230008-5f3141c8851a/go.mod h1:y2yVLIE/CSMCPXaHnSKXxu1spLPnglFLegmgdY23uuE=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a h1:tPE/Kp+x9dMSwUm/uM0JKK0IfdiJkwAbSMSeZBXXJXc=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a/go.mod h1:gw1tLEfykwDz2ET4a12jcXt4couGAm7IwsVaTy0Sflo=
-google.golang.org/grpc v1.74.2 h1:WoosgB65DlWVC9FqI82dGsZhWFNBSLjQ84bjROOpMu4=
-google.golang.org/grpc v1.74.2/go.mod h1:CtQ+BGjaAIXHs/5YS3i473GqwBBa1zGQNevxdeBEXrM=
-google.golang.org/protobuf v1.36.7 h1:IgrO7UwFQGJdRNXH/sQux4R1Dj1WAKcLElzeeRaXV2A=
-google.golang.org/protobuf v1.36.7/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
+google.golang.org/genproto/googleapis/api v0.0.0-20250826171959-ef028d996bc1 h1:APHvLLYBhtZvsbnpkfknDZ7NyH4z5+ub/I0u8L3Oz6g=
+google.golang.org/genproto/googleapis/api v0.0.0-20250826171959-ef028d996bc1/go.mod h1:xUjFWUnWDpZ/C0Gu0qloASKFb6f8/QXiiXhSPFsD668=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250826171959-ef028d996bc1 h1:pmJpJEvT846VzausCQ5d7KreSROcDqmO388w5YbnltA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250826171959-ef028d996bc1/go.mod h1:GmFNa4BdJZ2a8G+wCe9Bg3wwThLrJun751XstdJt5Og=
+google.golang.org/grpc v1.75.0 h1:+TW+dqTd2Biwe6KKfhE5JpiYIBWq865PhKGSXiivqt4=
+google.golang.org/grpc v1.75.0/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
+google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
+google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
@@ -297,8 +288,8 @@ howett.net/plist v1.0.1 h1:37GdZ8tP09Q35o9ych3ehygcsL+HqKSwzctveSlarvM=
 howett.net/plist v1.0.1/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=
 mvdan.cc/editorconfig v0.3.0 h1:D1D2wLYEYGpawWT5SpM5pRivgEgXjtEXwC9MWhEY0gQ=
 mvdan.cc/editorconfig v0.3.0/go.mod h1:NcJHuDtNOTEJ6251indKiWuzK6+VcrMuLzGMLKBFupQ=
-mvdan.cc/gofumpt v0.8.0 h1:nZUCeC2ViFaerTcYKstMmfysj6uhQrA2vJe+2vwGU6k=
-mvdan.cc/gofumpt v0.8.0/go.mod h1:vEYnSzyGPmjvFkqJWtXkh79UwPWP9/HMxQdGEXZHjpg=
+mvdan.cc/gofumpt v0.9.0 h1:W0wNHMSvDBDIyZsm3nnGbVfgp5AknzBrGJnfLCy501w=
+mvdan.cc/gofumpt v0.9.0/go.mod h1:3xYtNemnKiXaTh6R4VtlqDATFwBbdXI8lJvH/4qk7mw=
 mvdan.cc/sh/v3 v3.12.0 h1:ejKUR7ONP5bb+UGHGEG/k9V5+pRVIyD+LsZz7o8KHrI=
 mvdan.cc/sh/v3 v3.12.0/go.mod h1:Se6Cj17eYSn+sNooLZiEUnNNmNxg0imoYlTu4CyaGyg=
 mvdan.cc/unparam v0.0.0-20250301125049-0df0534333a4 h1:WjUu4yQoT5BHT1w8Zu56SP8367OuBV5jvo+4Ulppyf8=
--- a/internal/aghalg/sortedmap.go
+++ b/internal/aghalg/sortedmap.go
@@ -5,7 +5,7 @@ import (
 )

 // SortedMap is a map that keeps elements in order with internal sorting
-// function.  Must be initialised by the [NewSortedMap].
+// function.  Must be initialized by the [NewSortedMap].
 type SortedMap[K comparable, V any] struct {
 	vals map[K]V
 	cmp  func(a, b K) (res int)
@@ -38,7 +38,9 @@ func (m *SortedMap[K, V]) Set(key K, val V) {
 // Get returns val by key from the sorted map.
 func (m *SortedMap[K, V]) Get(key K) (val V, ok bool) {
 	if m == nil {
-		return
+		var zero V
+
+		return zero, false
 	}

 	val, ok = m.vals[key]
--- a/internal/arpdb/arpdb_linux.go
+++ b/internal/arpdb/arpdb_linux.go
@@ -139,9 +139,9 @@ func (arp *fsysARPDB) Neighbors() (ns []Neighbor) {
 //	IP address     HW type  Flags  HW address         Mask  Device
 //	192.168.11.98  0x1      0x2    5a:92:df:a9:7e:28  *     wan
 func parseArpAWrt(logger *slog.Logger, sc *bufio.Scanner, lenHint int) (ns []Neighbor) {
+	// Skip the header.
 	if !sc.Scan() {
-		// Skip the header.
-		return
+		return nil
 	}

 	ns = make([]Neighbor, 0, lenHint)
--- a/internal/client/addrproc.go
+++ b/internal/client/addrproc.go
@@ -268,7 +268,7 @@ func (p *DefaultAddrProc) processRDNS(ctx context.Context, ip netip.Addr) (host

 	ok := p.shouldResolve(ip)
 	if !ok {
-		return
+		return ""
 	}

 	host, changed := p.rdns.Process(ctx, ip)
--- a/internal/client/storage_test.go
+++ b/internal/client/storage_test.go
@@ -22,6 +22,7 @@ import (
 	"github.com/AdguardTeam/golibs/service"
 	"github.com/AdguardTeam/golibs/testutil"
 	"github.com/AdguardTeam/golibs/testutil/faketime"
+	"github.com/AdguardTeam/golibs/testutil/servicetest"
 	"github.com/AdguardTeam/golibs/timeutil"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -148,12 +149,7 @@ func TestStorage_Add_hostsfile(t *testing.T) {
 	})
 	require.NoError(t, err)

-	err = storage.Start(testutil.ContextWithTimeout(t, testTimeout))
-	require.NoError(t, err)
-
-	testutil.CleanupAndRequireSuccess(t, func() (err error) {
-		return storage.Shutdown(testutil.ContextWithTimeout(t, testTimeout))
-	})
+	servicetest.RequireRun(t, storage, testTimeout)

 	t.Run("add_hosts", func(t *testing.T) {
 		var s *hostsfile.DefaultStorage
@@ -167,15 +163,11 @@ func TestStorage_Add_hostsfile(t *testing.T) {

 		testutil.RequireSend(t, hostCh, s, testTimeout)

-		require.Eventually(t, func() (ok bool) {
+		require.EventuallyWithT(t, func(ct *assert.CollectT) {
 			cli1 := storage.ClientRuntime(cliIP1)
-			if cli1 == nil {
-				return false
-			}
+			require.NotNil(ct, cli1)

-			assert.True(t, compareRuntimeInfo(cli1, client.SourceHostsFile, cliName1))
-
-			return true
+			assert.True(ct, compareRuntimeInfo(cli1, client.SourceHostsFile, cliName1))
 		}, testTimeout, testTimeout/10)
 	})

@@ -191,18 +183,14 @@ func TestStorage_Add_hostsfile(t *testing.T) {

 		testutil.RequireSend(t, hostCh, s, testTimeout)

-		require.Eventually(t, func() (ok bool) {
+		require.EventuallyWithT(t, func(ct *assert.CollectT) {
 			cli2 := storage.ClientRuntime(cliIP2)
-			if cli2 == nil {
-				return false
-			}
+			require.NotNil(ct, cli2)

-			assert.True(t, compareRuntimeInfo(cli2, client.SourceHostsFile, cliName2))
+			assert.True(ct, compareRuntimeInfo(cli2, client.SourceHostsFile, cliName2))

 			cli1 := storage.ClientRuntime(cliIP1)
-			require.Nil(t, cli1)
-
-			return true
+			require.Nil(ct, cli1)
 		}, testTimeout, testTimeout/10)
 	})
 }
@@ -239,12 +227,7 @@ func TestStorage_Add_arp(t *testing.T) {
 	})
 	require.NoError(t, err)

-	err = storage.Start(testutil.ContextWithTimeout(t, testTimeout))
-	require.NoError(t, err)
-
-	testutil.CleanupAndRequireSuccess(t, func() (err error) {
-		return storage.Shutdown(testutil.ContextWithTimeout(t, testTimeout))
-	})
+	servicetest.RequireRun(t, storage, testTimeout)

 	t.Run("add_hosts", func(t *testing.T) {
 		func() {
@@ -257,15 +240,11 @@ func TestStorage_Add_arp(t *testing.T) {
 			}}
 		}()

-		require.Eventually(t, func() (ok bool) {
+		require.EventuallyWithT(t, func(ct *assert.CollectT) {
 			cli1 := storage.ClientRuntime(cliIP1)
-			if cli1 == nil {
-				return false
-			}
+			require.NotNil(ct, cli1)

-			assert.True(t, compareRuntimeInfo(cli1, client.SourceARP, cliName1))
-
-			return true
+			assert.True(ct, compareRuntimeInfo(cli1, client.SourceARP, cliName1))
 		}, testTimeout, testTimeout/10)
 	})

@@ -280,18 +259,14 @@ func TestStorage_Add_arp(t *testing.T) {
 			}}
 		}()

-		require.Eventually(t, func() (ok bool) {
+		require.EventuallyWithT(t, func(ct *assert.CollectT) {
 			cli2 := storage.ClientRuntime(cliIP2)
-			if cli2 == nil {
-				return false
-			}
+			require.NotNil(ct, cli2)

-			assert.True(t, compareRuntimeInfo(cli2, client.SourceARP, cliName2))
+			assert.True(ct, compareRuntimeInfo(cli2, client.SourceARP, cliName2))

 			cli1 := storage.ClientRuntime(cliIP1)
-			require.Nil(t, cli1)
-
-			return true
+			require.Nil(ct, cli1)
 		}, testTimeout, testTimeout/10)
 	})
 }
@@ -436,12 +411,7 @@ func TestClientsDHCP(t *testing.T) {
 	})
 	require.NoError(t, err)

-	err = storage.Start(testutil.ContextWithTimeout(t, testTimeout))
-	require.NoError(t, err)
-
-	testutil.CleanupAndRequireSuccess(t, func() (err error) {
-		return storage.Shutdown(testutil.ContextWithTimeout(t, testTimeout))
-	})
+	servicetest.RequireRun(t, storage, testTimeout)

 	require.True(t, t.Run("find_runtime_lower_priority", func(t *testing.T) {
 		// Add a lower-priority client.
@@ -495,15 +465,11 @@ func TestClientsDHCP(t *testing.T) {
 		cli1 := storage.ClientRuntime(cliIP1)
 		require.NotNil(t, cli1)

-		require.Eventually(t, func() (ok bool) {
+		require.EventuallyWithT(t, func(ct *assert.CollectT) {
 			cli := storage.ClientRuntime(cliIP1)
-			if cli == nil {
-				return false
-			}
+			require.NotNil(ct, cli)

-			assert.True(t, compareRuntimeInfo(cli, client.SourceHostsFile, cliName1))
-
-			return true
+			assert.True(ct, compareRuntimeInfo(cli, client.SourceHostsFile, cliName1))
 		}, testTimeout, testTimeout/10)

 		// Remove the matching client.
@@ -515,10 +481,11 @@ func TestClientsDHCP(t *testing.T) {

 		testutil.RequireSend(t, etcHostsCh, s, testTimeout)

-		require.Eventually(t, func() (ok bool) {
+		require.EventuallyWithT(t, func(ct *assert.CollectT) {
 			cli := storage.ClientRuntime(cliIP1)
+			require.NotNil(ct, cli)

-			return compareRuntimeInfo(cli, client.SourceDHCP, cliName1)
+			assert.True(ct, compareRuntimeInfo(cli, client.SourceDHCP, cliName1))
 		}, testTimeout, testTimeout/10)
 	}))

--- a/internal/dhcpd/v4_unix.go
+++ b/internal/dhcpd/v4_unix.go
@@ -1096,9 +1096,7 @@ func (s *v4Server) handleRelease(req, resp *dhcpv4.DHCPv4) (err error) {

 		err = s.rmDynamicLease(l)
 		if err != nil {
-			err = fmt.Errorf("removing dynamic lease for %s: %w", mac, err)
-
-			return
+			return fmt.Errorf("removing dynamic lease for %s: %w", mac, err)
 		}

 		n++
@@ -1391,7 +1389,7 @@ func (s *v4Server) configureDNSIPAddrs(dnsIPAddrs []net.IP) {
 // Stop - stop server
 func (s *v4Server) Stop() (err error) {
 	if s.srv == nil {
-		return
+		return nil
 	}

 	log.Debug("dhcpv4: stopping")
--- a/internal/dhcpd/v6_unix.go
+++ b/internal/dhcpd/v6_unix.go
@@ -771,7 +771,7 @@ func (s *v6Server) Stop() (err error) {

 	// DHCPv6 server may not be initialized if ra_slaac_only=true
 	if s.srv == nil {
-		return
+		return nil
 	}

 	log.Debug("dhcpv6: stopping")
--- a/internal/dnsforward/config.go
+++ b/internal/dnsforward/config.go
@@ -648,7 +648,7 @@ func (s *Server) prepareTLS(ctx context.Context, proxyConf *proxy.Config) (err e
 	s.prepareDNSCrypt(proxyConf)

 	if s.conf.TLSConf.Cert == nil {
-		return
+		return nil
 	}

 	if s.conf.TLSConf.TLSListenAddrs == nil && s.conf.TLSConf.QUICListenAddrs == nil {
--- a/internal/dnsforward/configvalidator.go
+++ b/internal/dnsforward/configvalidator.go
@@ -191,29 +191,24 @@ func (cv *upstreamConfigValidator) check() {
 	}

 	wg := &sync.WaitGroup{}
-	wg.Add(len(cv.generalUpstreamResults) +
-		len(cv.fallbackUpstreamResults) +
-		len(cv.privateUpstreamResults))

 	for _, res := range cv.generalUpstreamResults {
-		go checkSrv(res, wg, commonChecker)
+		wg.Go(func() { checkSrv(res, commonChecker) })
 	}
 	for _, res := range cv.fallbackUpstreamResults {
-		go checkSrv(res, wg, commonChecker)
+		wg.Go(func() { checkSrv(res, commonChecker) })
 	}
 	for _, res := range cv.privateUpstreamResults {
-		go checkSrv(res, wg, arpaChecker)
+		wg.Go(func() { checkSrv(res, arpaChecker) })
 	}

 	wg.Wait()
 }

 // checkSrv runs hc on the server from res, if any, and stores any occurred
-// error in res.  wg is always marked done in the end.  It is intended to be
-// used as a goroutine.
-func checkSrv(res *upstreamResult, wg *sync.WaitGroup, hc *healthchecker) {
+// error in res.  It is used to be run in a separate goroutine.
+func checkSrv(res *upstreamResult, hc *healthchecker) {
 	defer log.OnPanic(fmt.Sprintf("dnsforward: checking upstream %s", res.server.Address()))
-	defer wg.Done()

 	res.err = hc.check(res.server)
 	if res.err != nil && res.isSpecific {
--- a/internal/dnsforward/dnsforward_internal_test.go
+++ b/internal/dnsforward/dnsforward_internal_test.go
@@ -316,10 +316,15 @@ func assertGoogleAResponse(tb testing.TB, reply *dns.Msg) {
 func assertResponse(tb testing.TB, reply *dns.Msg, ip netip.Addr) {
 	tb.Helper()

-	require.Lenf(tb, reply.Answer, 1, "dns server returned reply with wrong number of answers - %d", len(reply.Answer))
+	if !assert.Len(tb, reply.Answer, 1, "wrong number of answers") {
+		return
+	}

 	a, ok := reply.Answer[0].(*dns.A)
-	require.Truef(tb, ok, "dns server returned wrong answer type instead of A: %v", reply.Answer[0])
+	if !assert.True(tb, ok, "wrong answer type instead of A: %T", reply.Answer[0]) {
+		return
+	}
+
 	assert.Equal(tb, net.IP(ip.AsSlice()), a.A)
 }

@@ -333,11 +338,8 @@ func sendTestMessagesAsync(tb testing.TB, conn *dns.Conn) {

 	for range testMessagesCount {
 		msg := createGoogleATestMessage()
-		wg.Add(1)
-
-		go func() {
-			defer wg.Done()

+		wg.Go(func() {
 			err := conn.WriteMsg(msg)
 			require.NoErrorf(tb, err, "cannot write message: %s", err)

@@ -345,10 +347,14 @@ func sendTestMessagesAsync(tb testing.TB, conn *dns.Conn) {
 			require.NoErrorf(tb, err, "cannot read response to message: %s", err)

 			assertGoogleAResponse(tb, res)
-		}()
+		})
 	}

 	wg.Wait()
+
+	if tb.Failed() {
+		tb.FailNow()
+	}
 }

 func sendTestMessages(tb testing.TB, conn *dns.Conn) {
--- a/internal/home/clientshttp_internal_test.go
+++ b/internal/home/clientshttp_internal_test.go
@@ -85,11 +85,10 @@ func assertClients(tb testing.TB, want, got []*client.Persistent) {
 	slices.SortFunc(want, sortFunc)
 	slices.SortFunc(got, sortFunc)

-	slices.CompareFunc(want, got, func(a, b *client.Persistent) (n int) {
-		assert.True(tb, a.EqualIDs(b), "%q doesn't have the same ids as %q", a.Name, b.Name)
-
-		return 0
-	})
+	for i, a := range want {
+		b := got[i]
+		assert.Truef(tb, a.EqualIDs(b), "%q doesn't have the same ids as %q", a.Name, b.Name)
+	}
 }

 // assertPersistentClients is a helper function that uses HTTP API to check
--- a/internal/stats/stats_internal_test.go
+++ b/internal/stats/stats_internal_test.go
@@ -64,7 +64,7 @@ func TestStats_races(t *testing.T) {
 		readersNum = 5
 	)

-	for round := 0; round < roundsNum; round++ {
+	for round := range roundsNum {
 		atomic.StoreUint32(&r, uint32(round))

 		startWG, finWG := &sync.WaitGroup{}, &sync.WaitGroup{}
--- a/scripts/make/go-build.sh
+++ b/scripts/make/go-build.sh
@@ -118,9 +118,6 @@ fi
 readonly CGO_ENABLED race_flags
 export CGO_ENABLED

-GO111MODULE='on'
-export GO111MODULE
-
 # Build the new binary if requested.
 if [ "${NEXTAPI:-0}" -eq '0' ]; then
 	tags_flags='--tags='
@@ -147,5 +144,4 @@ fi
 	--trimpath \
 	"$o_flags" \
 	"$v_flags" \
-	"$x_flags" \
-	;
+	"$x_flags"
--- a/scripts/make/helper.sh
+++ b/scripts/make/helper.sh
@@ -6,7 +6,7 @@
 # right after the initial environment processing.

 # This comment is used to simplify checking local copies of the script.  Bump
-# this number every time a remarkable change is made to this script.
+# this number every time a significant change is made to this script.
 #
 # AdGuard-Project-Version: 5

--- a/scripts/make/md-lint.sh
+++ b/scripts/make/md-lint.sh
@@ -1,15 +1,14 @@
 #!/bin/sh

 # This comment is used to simplify checking local copies of the script.  Bump
-# this number every time a remarkable change is made to this script.
+# this number every time a significant change is made to this script.
 #
 # AdGuard-Project-Version: 3

 verbose="${VERBOSE:-0}"
 readonly verbose

-# Don't use -f, because we use globs in this script.
-set -e -u
+set -e -f -u

 if [ "$verbose" -gt '0' ]; then
 	set -x
--- a/scripts/make/sh-lint.sh
+++ b/scripts/make/sh-lint.sh
@@ -1,7 +1,7 @@
 #!/bin/sh

 # This comment is used to simplify checking local copies of the script.  Bump
-# this number every time a remarkable change is made to this script.
+# this number every time a significant change is made to this script.
 #
 # AdGuard-Project-Version: 3

--- a/scripts/make/txt-lint.sh
+++ b/scripts/make/txt-lint.sh
@@ -1,9 +1,9 @@
 #!/bin/sh

 # This comment is used to simplify checking local copies of the script.  Bump
-# this number every time a remarkable change is made to this script.
+# this number every time a significant change is made to this script.
 #
-# AdGuard-Project-Version: 9
+# AdGuard-Project-Version: 10

 verbose="${VERBOSE:-0}"
 readonly verbose
@@ -80,6 +80,8 @@ trailing_whitespace() {
 		done
 }

+# TODO(a.garipov):  Consider using jq for JSON validation.
+
 run_linter -e trailing_newlines

 run_linter -e trailing_whitespace
--- a/scripts/translations/download.go
+++ b/scripts/translations/download.go
@@ -41,17 +41,21 @@ func (c *twoskyClient) download(ctx context.Context, l *slog.Logger) (err error)

 	downloadURI := c.uri.JoinPath("download")

-	client := &http.Client{
-		Timeout: 10 * time.Second,
-	}
-
 	wg := &sync.WaitGroup{}
-	failed := &sync.Map{}
 	uriCh := make(chan *url.URL, len(c.langs))

+	dw := &downloadWorker{
+		ctx:    ctx,
+		l:      l,
+		failed: &sync.Map{},
+		client: &http.Client{
+			Timeout: 10 * time.Second,
+		},
+		uriCh: uriCh,
+	}
+
 	for range numWorker {
-		wg.Add(1)
-		go downloadWorker(ctx, l, wg, failed, client, uriCh)
+		wg.Go(dw.run)
 	}

 	for _, lang := range c.langs {
@@ -63,7 +67,7 @@ func (c *twoskyClient) download(ctx context.Context, l *slog.Logger) (err error)
 	close(uriCh)
 	wg.Wait()

-	printFailedLocales(ctx, l, failed)
+	printFailedLocales(ctx, l, dw.failed)

 	return nil
 }
@@ -90,26 +94,28 @@ func printFailedLocales(ctx context.Context, l *slog.Logger, failed *sync.Map) {
 	l.InfoContext(ctx, "failed", "locales", keys)
 }

-// downloadWorker downloads translations by received urls and saves them.
-// Where failed is a map for storing failed downloads.
-func downloadWorker(
-	ctx context.Context,
-	l *slog.Logger,
-	wg *sync.WaitGroup,
-	failed *sync.Map,
-	client *http.Client,
-	uriCh <-chan *url.URL,
-) {
-	defer wg.Done()
+// downloadWorker is a worker for downloading translations.  It uses URLs
+// received from the channel to download translations and save them to files.
+// Failures are stored in the failed map.  All fields must not be nil.
+type downloadWorker struct {
+	ctx    context.Context
+	l      *slog.Logger
+	failed *sync.Map
+	client *http.Client
+	uriCh  <-chan *url.URL
+}

-	for uri := range uriCh {
+// run handles the channel of URLs, one by one.  It returns when the channel is
+// closed.  It's used to be run in a separate goroutine.
+func (w *downloadWorker) run() {
+	for uri := range w.uriCh {
 		q := uri.Query()
 		code := q.Get("language")

-		err := saveToFile(ctx, l, client, uri, code)
+		err := saveToFile(w.ctx, w.l, w.client, uri, code)
 		if err != nil {
-			l.ErrorContext(ctx, "download worker", slogutil.KeyError, err)
-			failed.Store(code, struct{}{})
+			w.l.ErrorContext(w.ctx, "download worker", slogutil.KeyError, err)
+			w.failed.Store(code, struct{}{})
 		}
 	}
 }