diff --git a/build/deploy/atlas/docker-compose.yml b/build/deploy/atlas/docker-compose.yml
index 142ece20..92618dc3 100644
--- a/build/deploy/atlas/docker-compose.yml
+++ b/build/deploy/atlas/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
   atlas-api:
-    image: ghcr.io/thingspect/atlas:668811d
+    image: ghcr.io/thingspect/atlas:aa4f930
     command: atlas-api
     restart: on-failure
     ports:
@@ -22,7 +22,7 @@ services:
       - API_LORA_DEV_PROF_ID=00000000-0000-0000-0000-000000000000
 
   atlas-mqtt-ingestor:
-    image: ghcr.io/thingspect/atlas:668811d
+    image: ghcr.io/thingspect/atlas:aa4f930
     command: atlas-mqtt-ingestor
     restart: on-failure
     environment:
@@ -32,7 +32,7 @@ services:
       - MQTT_INGEST_NSQ_PUB_ADDR=nsqd:4150
 
   atlas-lora-ingestor:
-    image: ghcr.io/thingspect/atlas:668811d
+    image: ghcr.io/thingspect/atlas:aa4f930
     command: atlas-lora-ingestor
     restart: on-failure
     environment:
@@ -42,7 +42,7 @@ services:
       - LORA_INGEST_NSQ_PUB_ADDR=nsqd:4150
 
   atlas-decoder:
-    image: ghcr.io/thingspect/atlas:668811d
+    image: ghcr.io/thingspect/atlas:aa4f930
     command: atlas-decoder
     restart: on-failure
     environment:
@@ -53,7 +53,7 @@ services:
       - DECODER_NSQ_LOOKUP_ADDRS=nsqlookupd:4161
 
   atlas-validator:
-    image: ghcr.io/thingspect/atlas:668811d
+    image: ghcr.io/thingspect/atlas:aa4f930
     command: atlas-validator
     restart: on-failure
     environment:
@@ -64,7 +64,7 @@ services:
       - VALIDATOR_NSQ_LOOKUP_ADDRS=nsqlookupd:4161
 
   atlas-accumulator:
-    image: ghcr.io/thingspect/atlas:668811d
+    image: ghcr.io/thingspect/atlas:aa4f930
     command: atlas-accumulator
     restart: on-failure
     environment:
@@ -75,7 +75,7 @@ services:
       - ACCUMULATOR_NSQ_LOOKUP_ADDRS=nsqlookupd:4161
 
   atlas-eventer:
-    image: ghcr.io/thingspect/atlas:668811d
+    image: ghcr.io/thingspect/atlas:aa4f930
     command: atlas-eventer
     restart: on-failure
     environment:
@@ -86,7 +86,7 @@ services:
       - EVENTER_NSQ_LOOKUP_ADDRS=nsqlookupd:4161
 
   atlas-alerter:
-    image: ghcr.io/thingspect/atlas:668811d
+    image: ghcr.io/thingspect/atlas:aa4f930
     command: atlas-alerter
     restart: on-failure
     environment:
diff --git a/go.mod b/go.mod
index 556e8f89..204165fd 100644
--- a/go.mod
+++ b/go.mod
@@ -21,7 +21,7 @@ require (
 	github.com/thingspect/proto/go v1.1.22
 	github.com/valkey-io/valkey-go v1.0.77
 	go.uber.org/mock v0.6.0
-	golang.org/x/crypto v0.56.0
+	golang.org/x/crypto v0.57.0
 	google.golang.org/grpc v1.83.2
 	google.golang.org/protobuf v1.36.12
 )
@@ -39,8 +39,8 @@ require (
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
-	golang.org/x/exp v0.0.0-20260824195058-e88cd73687aa // indirect
-	golang.org/x/net v0.58.0 // indirect
+	golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba // indirect
+	golang.org/x/net v0.59.0 // indirect
 	golang.org/x/sync v0.23.0 // indirect
 	golang.org/x/sys v0.48.0 // indirect
 	golang.org/x/text v0.42.0 // indirect
diff --git a/go.sum b/go.sum
index 3210760b..edd8be0a 100644
--- a/go.sum
+++ b/go.sum
@@ -102,12 +102,12 @@ go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
 go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
-golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
-golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
-golang.org/x/exp v0.0.0-20260824195058-e88cd73687aa h1:QSyA8ishJCyT21kER9KwNt0b7BM3iRK4x9QXhjN5Fdk=
-golang.org/x/exp v0.0.0-20260824195058-e88cd73687aa/go.mod h1:zeBbvyFKDaLwa7CH/zI8KXt7gTl14SF7sO08Pl5jBCM=
-golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
-golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
+golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba h1:Ck8QetSgk912qxWLMCKxd0in+aiyBQyDSMae6e/xmpU=
+golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba/go.mod h1:50RgIsmK7OwqzTTeqcSXQW8SswW0o8fRcDxmqGluJ8E=
+golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
+golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
 golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
diff --git a/pkg/dao/alarm/crudl.go b/pkg/dao/alarm/crudl.go
index 89274429..d910eabc 100644
--- a/pkg/dao/alarm/crudl.go
+++ b/pkg/dao/alarm/crudl.go
@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/jackc/pgx/v5/pgtype"
 	"github.com/thingspect/atlas/pkg/alog"
 	"github.com/thingspect/atlas/pkg/dao"
 	"github.com/thingspect/proto/go/api"
@@ -53,11 +52,11 @@ func (d *DAO) Read(ctx context.Context, alarmID, orgID, ruleID string) (
 	var status, alarmType string
 	var createdAt, updatedAt time.Time
 
-	if err := d.ro.QueryRowContext(ctx, readAlarm, alarmID, orgID, ruleID).Scan(
-		&alarm.Id, &alarm.OrgId, &alarm.RuleId, &alarm.Name, &status,
-		&alarmType, pgtype.NewMap().SQLScanner(&alarm.UserTags),
-		&alarm.SubjectTemplate, &alarm.BodyTemplate, &alarm.RepeatInterval,
-		&createdAt, &updatedAt); err != nil {
+	if err := d.ro.QueryRowContext(ctx, readAlarm, alarmID, orgID, ruleID).
+		Scan(&alarm.Id, &alarm.OrgId, &alarm.RuleId, &alarm.Name, &status,
+			&alarmType, &alarm.UserTags, &alarm.SubjectTemplate,
+			&alarm.BodyTemplate, &alarm.RepeatInterval, &createdAt,
+			&updatedAt); err != nil {
 		return nil, dao.DBToSentinel(err)
 	}
 
@@ -170,8 +169,8 @@ func (d *DAO) List(
 
 	// Run count query.
 	var count int32
-	if err := d.ro.QueryRowContext(ctx, cQuery, cArgs...).Scan(
-		&count); err != nil {
+	if err := d.ro.QueryRowContext(ctx, cQuery, cArgs...).
+		Scan(&count); err != nil {
 		return nil, 0, dao.DBToSentinel(err)
 	}
 
@@ -211,16 +210,15 @@ func (d *DAO) List(
 	}()
 
 	var alarms []*api.Alarm
-	pgtmap := pgtype.NewMap()
 	for rows.Next() {
 		alarm := &api.Alarm{}
 		var status, alarmType string
 		var createdAt, updatedAt time.Time
 
 		if err = rows.Scan(&alarm.Id, &alarm.OrgId, &alarm.RuleId, &alarm.Name,
-			&status, &alarmType, pgtmap.SQLScanner(&alarm.UserTags),
-			&alarm.SubjectTemplate, &alarm.BodyTemplate, &alarm.RepeatInterval,
-			&createdAt, &updatedAt); err != nil {
+			&status, &alarmType, &alarm.UserTags, &alarm.SubjectTemplate,
+			&alarm.BodyTemplate, &alarm.RepeatInterval, &createdAt,
+			&updatedAt); err != nil {
 			return nil, 0, dao.DBToSentinel(err)
 		}
 
diff --git a/pkg/dao/device/crudl.go b/pkg/dao/device/crudl.go
index 88503504..59286f47 100644
--- a/pkg/dao/device/crudl.go
+++ b/pkg/dao/device/crudl.go
@@ -7,7 +7,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/jackc/pgx/v5/pgtype"
 	"github.com/thingspect/atlas/pkg/alog"
 	"github.com/thingspect/atlas/pkg/cache"
 	"github.com/thingspect/atlas/pkg/dao"
@@ -76,8 +75,7 @@ func (d *DAO) Read(ctx context.Context, devID, orgID string) (
 
 	if err := d.ro.QueryRowContext(ctx, readDevice, devID, orgID).Scan(&dev.Id,
 		&dev.OrgId, &dev.UniqId, &dev.Name, &status, &dev.Token, &decoder,
-		pgtype.NewMap().SQLScanner(&dev.Tags), &createdAt,
-		&updatedAt); err != nil {
+		&dev.Tags, &createdAt, &updatedAt); err != nil {
 		return nil, dao.DBToSentinel(err)
 	}
 
@@ -138,10 +136,9 @@ func (d *DAO) ReadByUniqID(ctx context.Context, uniqID string) (
 	var status, decoder string
 	var createdAt, updatedAt time.Time
 
-	if err := d.ro.QueryRowContext(ctx, readDeviceByUniqID, uniqID).Scan(
-		&dev.Id, &dev.OrgId, &dev.UniqId, &dev.Name, &status, &dev.Token,
-		&decoder, pgtype.NewMap().SQLScanner(&dev.Tags), &createdAt,
-		&updatedAt); err != nil {
+	if err := d.ro.QueryRowContext(ctx, readDeviceByUniqID, uniqID).
+		Scan(&dev.Id, &dev.OrgId, &dev.UniqId, &dev.Name, &status, &dev.Token,
+			&decoder, &dev.Tags, &createdAt, &updatedAt); err != nil {
 		return nil, dao.DBToSentinel(err)
 	}
 
@@ -301,8 +298,8 @@ func (d *DAO) List(
 
 	// Run count query.
 	var count int32
-	if err := d.ro.QueryRowContext(ctx, cQuery, cArgs...).Scan(
-		&count); err != nil {
+	if err := d.ro.QueryRowContext(ctx, cQuery, cArgs...).
+		Scan(&count); err != nil {
 		return nil, 0, dao.DBToSentinel(err)
 	}
 
@@ -342,14 +339,13 @@ func (d *DAO) List(
 	}()
 
 	var devs []*api.Device
-	pgtmap := pgtype.NewMap()
 	for rows.Next() {
 		dev := &api.Device{}
 		var status, decoder string
 		var createdAt, updatedAt time.Time
 
 		if err = rows.Scan(&dev.Id, &dev.OrgId, &dev.UniqId, &dev.Name, &status,
-			&dev.Token, &decoder, pgtmap.SQLScanner(&dev.Tags), &createdAt,
+			&dev.Token, &decoder, &dev.Tags, &createdAt,
 			&updatedAt); err != nil {
 			return nil, 0, dao.DBToSentinel(err)
 		}
diff --git a/pkg/dao/user/crudl.go b/pkg/dao/user/crudl.go
index c1190967..ef9d7879 100644
--- a/pkg/dao/user/crudl.go
+++ b/pkg/dao/user/crudl.go
@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/jackc/pgx/v5/pgtype"
 	"github.com/thingspect/atlas/pkg/alog"
 	"github.com/thingspect/atlas/pkg/dao"
 	"github.com/thingspect/proto/go/api"
@@ -50,10 +49,10 @@ func (d *DAO) Read(ctx context.Context, userID, orgID string) (
 	var role, status string
 	var createdAt, updatedAt time.Time
 
-	if err := d.ro.QueryRowContext(ctx, readUser, userID, orgID).Scan(&user.Id,
-		&user.OrgId, &user.Name, &user.Email, &user.Phone, &role, &status,
-		pgtype.NewMap().SQLScanner(&user.Tags), &user.AppKey, &createdAt,
-		&updatedAt); err != nil {
+	if err := d.ro.QueryRowContext(ctx, readUser, userID, orgID).
+		Scan(&user.Id, &user.OrgId, &user.Name, &user.Email, &user.Phone, &role,
+			&status, &user.Tags, &user.AppKey, &createdAt,
+			&updatedAt); err != nil {
 		return nil, dao.DBToSentinel(err)
 	}
 
@@ -82,10 +81,10 @@ func (d *DAO) ReadByEmail(ctx context.Context, email, orgName string) (
 	var role, status string
 	var createdAt, updatedAt time.Time
 
-	if err := d.ro.QueryRowContext(ctx, readUserByEmail, email, orgName).Scan(
-		&user.Id, &user.OrgId, &user.Name, &user.Email, &user.Phone, &passHash,
-		&role, &status, pgtype.NewMap().SQLScanner(&user.Tags), &user.AppKey,
-		&createdAt, &updatedAt); err != nil {
+	if err := d.ro.QueryRowContext(ctx, readUserByEmail, email, orgName).
+		Scan(&user.Id, &user.OrgId, &user.Name, &user.Email, &user.Phone,
+			&passHash, &role, &status, &user.Tags, &user.AppKey, &createdAt,
+			&updatedAt); err != nil {
 		return nil, nil, dao.DBToSentinel(err)
 	}
 
@@ -217,8 +216,8 @@ func (d *DAO) List(
 
 	// Run count query.
 	var count int32
-	if err := d.ro.QueryRowContext(ctx, cQuery, cArgs...).Scan(
-		&count); err != nil {
+	if err := d.ro.QueryRowContext(ctx, cQuery, cArgs...).
+		Scan(&count); err != nil {
 		return nil, 0, dao.DBToSentinel(err)
 	}
 
@@ -258,15 +257,14 @@ func (d *DAO) List(
 	}()
 
 	var users []*api.User
-	pgtmap := pgtype.NewMap()
 	for rows.Next() {
 		user := &api.User{}
 		var role, status string
 		var createdAt, updatedAt time.Time
 
 		if err = rows.Scan(&user.Id, &user.OrgId, &user.Name, &user.Email,
-			&user.Phone, &role, &status, pgtmap.SQLScanner(&user.Tags),
-			&user.AppKey, &createdAt, &updatedAt); err != nil {
+			&user.Phone, &role, &status, &user.Tags, &user.AppKey, &createdAt,
+			&updatedAt); err != nil {
 			return nil, 0, dao.DBToSentinel(err)
 		}
 
@@ -312,15 +310,14 @@ func (d *DAO) ListByTags(ctx context.Context, orgID string, tags []string) (
 	}()
 
 	var users []*api.User
-	pgtmap := pgtype.NewMap()
 	for rows.Next() {
 		user := &api.User{}
 		var role, status string
 		var createdAt, updatedAt time.Time
 
 		if err = rows.Scan(&user.Id, &user.OrgId, &user.Name, &user.Email,
-			&user.Phone, &role, &status, pgtmap.SQLScanner(&user.Tags),
-			&user.AppKey, &createdAt, &updatedAt); err != nil {
+			&user.Phone, &role, &status, &user.Tags, &user.AppKey, &createdAt,
+			&updatedAt); err != nil {
 			return nil, dao.DBToSentinel(err)
 		}
 
diff --git a/vendor/golang.org/x/net/http2/ascii.go b/vendor/golang.org/x/net/http2/ascii.go
index 17caa205..3a7aed12 100644
--- a/vendor/golang.org/x/net/http2/ascii.go
+++ b/vendor/golang.org/x/net/http2/ascii.go
@@ -4,7 +4,9 @@
 
 package http2
 
-import "strings"
+import (
+	"strings"
+)
 
 // The HTTP protocols are defined in terms of ASCII, not Unicode. This file
 // contains helper functions which may use Unicode-aware functions which would
@@ -43,6 +45,16 @@ func isASCIIPrint(s string) bool {
 	return true
 }
 
+// isASCII returns whether s is ASCII.
+func isASCII(s string) bool {
+	for i := 0; i < len(s); i++ {
+		if s[i] > 0x7f {
+			return false
+		}
+	}
+	return true
+}
+
 // asciiToLower returns the lowercase version of s if s is ASCII and printable,
 // and whether or not it was.
 func asciiToLower(s string) (lower string, ok bool) {
diff --git a/vendor/golang.org/x/net/http2/databuffer.go b/vendor/golang.org/x/net/http2/databuffer.go
index e6f55cbd..9763ab13 100644
--- a/vendor/golang.org/x/net/http2/databuffer.go
+++ b/vendor/golang.org/x/net/http2/databuffer.go
@@ -121,10 +121,7 @@ func (b *dataBuffer) Write(p []byte) (int, error) {
 		// If the last chunk is empty, allocate a new chunk. Try to allocate
 		// enough to fully copy p plus any additional bytes we expect to
 		// receive. However, this may allocate less than len(p).
-		want := int64(len(p))
-		if b.expected > want {
-			want = b.expected
-		}
+		want := max(int64(len(p)), b.expected)
 		chunk := b.lastChunkOrAlloc(want)
 		n := copy(chunk[b.w:], p)
 		p = p[n:]
diff --git a/vendor/golang.org/x/net/http2/server_common.go b/vendor/golang.org/x/net/http2/server_common.go
index 449538c8..fec36909 100644
--- a/vendor/golang.org/x/net/http2/server_common.go
+++ b/vendor/golang.org/x/net/http2/server_common.go
@@ -25,6 +25,8 @@ import (
 //
 //	https://golang.org/pkg/net/http/#ResponseWriter
 //	https://golang.org/pkg/net/http/#example_ResponseWriter_trailers
+//
+// Deprecated: Use [http.TrailerPrefix] instead.
 const TrailerPrefix = "Trailer:"
 
 // Push errors.
@@ -38,16 +40,22 @@ var (
 // The configuration conf may be nil.
 //
 // ConfigureServer must be called before s begins serving.
+//
+// Deprecated: Set [http.Server.Protocols] instead.
 func ConfigureServer(s *http.Server, conf *Server) error {
 	return configureServer(s, conf)
 }
 
 // Server is an HTTP/2 server.
+//
+// Deprecated: Use [http.Server] instead.
 type Server struct {
 	// MaxHandlers limits the number of http.Handler ServeHTTP goroutines
 	// which may run at a time over all connections.
 	// Negative or zero no limit.
 	// TODO: implement
+	//
+	// Deprecated: This field has never had any effect.
 	MaxHandlers int
 
 	// MaxConcurrentStreams optionally specifies the number of
@@ -56,6 +64,9 @@ type Server struct {
 	// which may be active globally, which is MaxHandlers.
 	// If zero, MaxConcurrentStreams defaults to at least 100, per
 	// the HTTP/2 spec's recommendations.
+	//
+	// Deprecated: Use [http.Server.HTTP2] and
+	// [http.HTTP2Config.MaxConcurrentStreams] instead.
 	MaxConcurrentStreams uint32
 
 	// MaxDecoderHeaderTableSize optionally specifies the http2
@@ -63,44 +74,67 @@ type Server struct {
 	// informs the remote endpoint of the maximum size of the header compression
 	// table used to decode header blocks, in octets. If zero, the default value
 	// of 4096 is used.
+	//
+	// Deprecated: Use [http.Server.HTTP2] and
+	// [http.HTTP2Config.MaxDecoderHeaderTableSize] instead.
 	MaxDecoderHeaderTableSize uint32
 
 	// MaxEncoderHeaderTableSize optionally specifies an upper limit for the
 	// header compression table used for encoding request headers. Received
 	// SETTINGS_HEADER_TABLE_SIZE settings are capped at this limit. If zero,
 	// the default value of 4096 is used.
+	//
+	// Deprecated: Use [http.Server.HTTP2] and
+	// [http.HTTP2Config.MaxEncoderHeaderTableSize] instead.
 	MaxEncoderHeaderTableSize uint32
 
 	// MaxReadFrameSize optionally specifies the largest frame
 	// this server is willing to read. A valid value is between
 	// 16k and 16M, inclusive. If zero or otherwise invalid, a
 	// default value is used.
+	//
+	// Deprecated: Use [http.Server.HTTP2] and
+	// [http.HTTP2Config.MaxReadFrameSize] instead.
 	MaxReadFrameSize uint32
 
 	// PermitProhibitedCipherSuites, if true, permits the use of
 	// cipher suites prohibited by the HTTP/2 spec.
+	//
+	// Deprecated: Use [http.Server.HTTP2] and
+	// [http.HTTP2Config.PermitProhibitedCipherSuites] instead.
 	PermitProhibitedCipherSuites bool
 
 	// IdleTimeout specifies how long until idle clients should be
 	// closed with a GOAWAY frame. PING frames are not considered
 	// activity for the purposes of IdleTimeout.
 	// If zero or negative, there is no timeout.
+	//
+	// Deprecated: Use [http.Server.IdleTimeout] instead.
 	IdleTimeout time.Duration
 
 	// ReadIdleTimeout is the timeout after which a health check using a ping
 	// frame will be carried out if no frame is received on the connection.
 	// If zero, no health check is performed.
+	//
+	// Deprecated: Use [http.Server.HTTP2] and
+	// [http.HTTP2Config.SendPingTimeout] instead.
 	ReadIdleTimeout time.Duration
 
 	// PingTimeout is the timeout after which the connection will be closed
 	// if a response to a ping is not received.
 	// If zero, a default of 15 seconds is used.
+	//
+	// Deprecated: Use [http.Server.HTTP2] and
+	// [http.HTTP2Config.PingTimeout] instead.
 	PingTimeout time.Duration
 
 	// WriteByteTimeout is the timeout after which a connection will be
 	// closed if no data can be written to it. The timeout begins when data is
 	// available to write, and is extended whenever any bytes are written.
 	// If zero or negative, there is no timeout.
+	//
+	// Deprecated: Use [http.Server.HTTP2] and
+	// [http.HTTP2Config.WriteByteTimeout] instead.
 	WriteByteTimeout time.Duration
 
 	// MaxUploadBufferPerConnection is the size of the initial flow
@@ -108,12 +142,18 @@ type Server struct {
 	// allow this to be smaller than 65535 or larger than 2^32-1.
 	// If the value is outside this range, a default value will be
 	// used instead.
+	//
+	// Deprecated: Use [http.Server.HTTP2] and
+	// [http.HTTP2Config.MaxReceiveBufferPerConnection] instead.
 	MaxUploadBufferPerConnection int32
 
 	// MaxUploadBufferPerStream is the size of the initial flow control
 	// window for each stream. The HTTP/2 spec does not allow this to
 	// be larger than 2^32-1. If the value is zero or larger than the
 	// maximum, a default value will be used instead.
+	//
+	// Deprecated: Use [http.Server.HTTP2] and
+	// [http.HTTP2Config.MaxReceiveBufferPerStream] instead.
 	MaxUploadBufferPerStream int32
 
 	// NewWriteScheduler constructs a write scheduler for a connection.
@@ -126,6 +166,9 @@ type Server struct {
 	// It's intended to increment a metric for monitoring, such
 	// as an expvar or Prometheus metric.
 	// The errType consists of only ASCII word characters.
+	//
+	// Deprecated: Use [http.Server.HTTP2] and
+	// [http.HTTP2Config.CountError] instead.
 	CountError func(errType string)
 
 	// Internal state. This is a pointer (rather than embedded directly)
@@ -135,6 +178,8 @@ type Server struct {
 }
 
 // ServeConnOpts are options for the Server.ServeConn method.
+//
+// Deprecated: ServeConnOpts is deprecated.
 type ServeConnOpts struct {
 	// Context is the base context to use.
 	// If nil, context.Background is used.
@@ -178,6 +223,8 @@ type ServeConnOpts struct {
 // implemented in terms of providing a suitably-behaving net.Conn.
 //
 // The opts parameter is optional. If nil, default values are used.
+//
+// Deprecated: Use [http.Server.Serve] or [http.Server.ServeTLS] instead.
 func (s *Server) ServeConn(c net.Conn, opts *ServeConnOpts) {
 	if opts == nil {
 		opts = &ServeConnOpts{}
diff --git a/vendor/golang.org/x/net/http2/transport.go b/vendor/golang.org/x/net/http2/transport.go
index 08ac409b..088eb9be 100644
--- a/vendor/golang.org/x/net/http2/transport.go
+++ b/vendor/golang.org/x/net/http2/transport.go
@@ -184,6 +184,8 @@ func (t *Transport) initConnPool() {
 
 // ClientConn is the state of a single HTTP/2 client connection to an
 // HTTP/2 server.
+//
+// Deprecated: Use [http.ClientConn] instead.
 type ClientConn struct {
 	t             *Transport
 	tconn         net.Conn             // usually *tls.Conn, except specialized impls
diff --git a/vendor/golang.org/x/net/http2/transport_common.go b/vendor/golang.org/x/net/http2/transport_common.go
index b9f52932..4f0333a7 100644
--- a/vendor/golang.org/x/net/http2/transport_common.go
+++ b/vendor/golang.org/x/net/http2/transport_common.go
@@ -24,6 +24,8 @@ import (
 // It returns an error if t1 has already been HTTP/2-enabled.
 //
 // Use ConfigureTransports instead to configure the HTTP/2 Transport.
+//
+// Deprecated: Set [http.Transport.Protocols] instead.
 func ConfigureTransport(t1 *http.Transport) error {
 	return configureTransport(t1)
 }
@@ -31,6 +33,8 @@ func ConfigureTransport(t1 *http.Transport) error {
 // ConfigureTransports configures a net/http HTTP/1 Transport to use HTTP/2.
 // It returns a new HTTP/2 Transport for further configuration.
 // It returns an error if t1 has already been HTTP/2-enabled.
+//
+// Deprecated: Set [http.Transport.Protocols] instead.
 func ConfigureTransports(t1 *http.Transport) (*Transport, error) {
 	return configureTransports(t1)
 }
@@ -39,6 +43,8 @@ func ConfigureTransports(t1 *http.Transport) (*Transport, error) {
 //
 // A Transport internally caches connections to servers. It is safe
 // for concurrent use by multiple goroutines.
+//
+// Deprecated: Use [http.Transport] instead.
 type Transport struct {
 	// DialTLSContext specifies an optional dial function with context for
 	// creating TLS connections for requests.
@@ -47,6 +53,8 @@ type Transport struct {
 	//
 	// If the returned net.Conn has a ConnectionState method like tls.Conn,
 	// it will be used to set http.Response.TLS.
+	//
+	// Deprecated: Use [http.Transport.DialTLSContext] instead.
 	DialTLSContext func(ctx context.Context, network, addr string, cfg *tls.Config) (net.Conn, error)
 
 	// DialTLS specifies an optional dial function for creating
@@ -54,17 +62,21 @@ type Transport struct {
 	//
 	// If DialTLSContext and DialTLS is nil, tls.Dial is used.
 	//
-	// Deprecated: Use DialTLSContext instead, which allows the transport
-	// to cancel dials as soon as they are no longer needed.
-	// If both are set, DialTLSContext takes priority.
+	// Deprecated: Use [http.Transport.DialTLSContext] instead.
 	DialTLS func(network, addr string, cfg *tls.Config) (net.Conn, error)
 
 	// TLSClientConfig specifies the TLS configuration to use with
 	// tls.Client. If nil, the default configuration is used.
+	//
+	// Deprecated: Use [http.Transport.TLSClientConfig] instead.
 	TLSClientConfig *tls.Config
 
 	// ConnPool optionally specifies an alternate connection pool to use.
 	// If nil, the default is used.
+	//
+	// Deprecated: To create a custom connection pool, implement
+	// [http.RoundTripper]. Use [http.Transport.NewClientConn]
+	// to create connections for the pool.
 	ConnPool ClientConnPool
 
 	// DisableCompression, if true, prevents the Transport from
@@ -75,10 +87,14 @@ type Transport struct {
 	// decoded in the Response.Body. However, if the user
 	// explicitly requested gzip it is not automatically
 	// uncompressed.
+	//
+	// Deprecated: Use [http.Transport.DisableCompression] instead.
 	DisableCompression bool
 
 	// AllowHTTP, if true, permits HTTP/2 requests using the insecure,
 	// plain-text "http" scheme. Note that this does not enable h2c support.
+	//
+	// Deprecated: Use [http.Transport.Protocols] instead.
 	AllowHTTP bool
 
 	// MaxHeaderListSize is the http2 SETTINGS_MAX_HEADER_LIST_SIZE to
@@ -88,6 +104,8 @@ type Transport struct {
 	// want to advertise an unlimited value to the peer, Transport
 	// interprets the highest possible value here (0xffffffff or 1<<32-1)
 	// to mean no limit.
+	//
+	// Deprecated: Use [http.Transport.MaxResponseHeaderBytes] instead.
 	MaxHeaderListSize uint32
 
 	// MaxReadFrameSize is the http2 SETTINGS_MAX_FRAME_SIZE to send in the
@@ -97,6 +115,9 @@ type Transport struct {
 	// according to the spec:
 	// https://datatracker.ietf.org/doc/html/rfc7540#section-6.5.2.
 	// Values are bounded in the range 16k to 16M.
+	//
+	// Deprecated: Use [http.Transport.HTTP2] and
+	// [http.HTTP2Config.MaxReadFrameSize] instead.
 	MaxReadFrameSize uint32
 
 	// MaxDecoderHeaderTableSize optionally specifies the http2
@@ -104,12 +125,18 @@ type Transport struct {
 	// informs the remote endpoint of the maximum size of the header compression
 	// table used to decode header blocks, in octets. If zero, the default value
 	// of 4096 is used.
+	//
+	// Deprecated: Use [http.Transport.HTTP2] and
+	// [http.HTTP2Config.MaxDecoderHeaderTableSize] instead.
 	MaxDecoderHeaderTableSize uint32
 
 	// MaxEncoderHeaderTableSize optionally specifies an upper limit for the
 	// header compression table used for encoding request headers. Received
 	// SETTINGS_HEADER_TABLE_SIZE settings are capped at this limit. If zero,
 	// the default value of 4096 is used.
+	//
+	// Deprecated: Use [http.Transport.HTTP2] and
+	// [http.HTTP2Config.MaxEncoderHeaderTableSize] instead.
 	MaxEncoderHeaderTableSize uint32
 
 	// StrictMaxConcurrentStreams controls whether the server's
@@ -120,12 +147,17 @@ type Transport struct {
 	// server's SETTINGS_MAX_CONCURRENT_STREAMS is interpreted as
 	// a global limit and callers of RoundTrip block when needed,
 	// waiting for their turn.
+	//
+	// Deprecated: Use [http.Transport.HTTP2] and
+	// [http.HTTP2Config.StrictMaxConcurrentRequests] instead.
 	StrictMaxConcurrentStreams bool
 
 	// IdleConnTimeout is the maximum amount of time an idle
 	// (keep-alive) connection will remain idle before closing
 	// itself.
 	// Zero means no limit.
+	//
+	// Deprecated: Use [http.Transport.IdleConnTimeout] instead.
 	IdleConnTimeout time.Duration
 
 	// ReadIdleTimeout is the timeout after which a health check using ping
@@ -134,22 +166,34 @@ type Transport struct {
 	// there is no other traffic on the connection, the health check will
 	// be performed every ReadIdleTimeout interval.
 	// If zero, no health check is performed.
+	//
+	// Deprecated: Use [http.Transport.HTTP2] and
+	// [http.HTTP2Config.SendPingTimeout] instead.
 	ReadIdleTimeout time.Duration
 
 	// PingTimeout is the timeout after which the connection will be closed
 	// if a response to Ping is not received.
 	// Defaults to 15s.
+	//
+	// Deprecated: Use [http.Transport.HTTP2] and
+	// [http.HTTP2Config.PingTimeout] instead.
 	PingTimeout time.Duration
 
 	// WriteByteTimeout is the timeout after which the connection will be
 	// closed no data can be written to it. The timeout begins when data is
 	// available to write, and is extended whenever any bytes are written.
+	//
+	// Deprecated: Use [http.Transport.HTTP2] and
+	// [http.HTTP2Config.WriteByteTimeout] instead.
 	WriteByteTimeout time.Duration
 
 	// CountError, if non-nil, is called on HTTP/2 transport errors.
 	// It's intended to increment a metric for monitoring, such
 	// as an expvar or Prometheus metric.
 	// The errType consists of only ASCII word characters.
+	//
+	// Deprecated: Use [http.Transport.HTTP2] and
+	// [http.HTTP2Config.CountError] instead.
 	CountError func(errType string)
 
 	// Internal state, differs between wrapped and non-wrapped implementations.
@@ -165,6 +209,10 @@ var (
 )
 
 // ClientConnPool manages a pool of HTTP/2 client connections.
+//
+// Deprecated: To create a custom connection pool, implement
+// [http.RoundTripper]. Use [http.Transport.NewClientConn]
+// to create connections for the pool.
 type ClientConnPool interface {
 	// GetClientConn returns a specific HTTP/2 connection (usually
 	// a TLS-TCP connection) to an HTTP/2 server. On success, the
@@ -177,6 +225,8 @@ type ClientConnPool interface {
 }
 
 // ClientConnState describes the state of a ClientConn.
+//
+// Deprecated: Use [http.ClientConn] instead.
 type ClientConnState struct {
 	// Closed is whether the connection is closed.
 	Closed bool
@@ -210,6 +260,8 @@ type ClientConnState struct {
 }
 
 // RoundTripOpt are options for the Transport.RoundTripOpt method.
+//
+// Deprecated: There are no options to set.
 type RoundTripOpt struct {
 	// OnlyCachedConn controls whether RoundTripOpt may
 	// create a new TCP connection. If set true and
@@ -222,11 +274,14 @@ type RoundTripOpt struct {
 	allowHTTP bool // allow http:// URLs
 }
 
+// Deprecated: Use [http.Transport.RoundTrip] instead.
 func (t *Transport) RoundTrip(req *http.Request) (*http.Response, error) {
 	return t.RoundTripOpt(req, RoundTripOpt{})
 }
 
 // RoundTripOpt is like RoundTrip, but takes options.
+//
+// Deprecated: Use [http.Transport.RoundTrip] instead.
 func (t *Transport) RoundTripOpt(req *http.Request, opt RoundTripOpt) (*http.Response, error) {
 	return t.roundTripOpt(req, opt)
 }
@@ -234,10 +289,15 @@ func (t *Transport) RoundTripOpt(req *http.Request, opt RoundTripOpt) (*http.Res
 // CloseIdleConnections closes any connections which were previously
 // connected from previous requests but are now sitting idle.
 // It does not interrupt any connections currently in use.
+//
+// Deprecated: Use [http.Transport.CloseIdleConnections] instead.
 func (t *Transport) CloseIdleConnections() {
 	t.closeIdleConnections()
 }
 
+// NewClientConn is deprecated.
+//
+// Deprecated: Use [http.Transport.NewClientConn] instead.
 func (t *Transport) NewClientConn(c net.Conn) (*ClientConn, error) {
 	return t.newUserClientConn(c)
 }
@@ -256,8 +316,15 @@ func authorityAddr(scheme string, authority string) (addr string) {
 			port = "80"
 		}
 	}
-	if a, err := idna.ToASCII(host); err == nil {
-		host = a
+	// Skip IDNA processing on hosts which are already ASCII.
+	// This is consistent with net/http and the WHATWG URL Specification.
+	// (We currently don't follow all of WHATWG, but we're aligned on
+	// permitting all-ASCII hostnames which fail IDNA validation.
+	// There are existing, valid domain names which TR #46 processing rejects.)
+	if !isASCII(host) {
+		if a, err := idna.Lookup.ToASCII(host); err == nil && a != "" {
+			host = a
+		}
 	}
 	// IPv6 address literal, without a port:
 	if strings.HasPrefix(host, "[") && strings.HasSuffix(host, "]") {
@@ -414,6 +481,8 @@ func (t *Transport) dialTLSWithContext(ctx context.Context, network, addr string
 
 // GoAwayError is returned by the Transport when the server closes the
 // TCP connection after sending a GOAWAY frame.
+//
+// Deprecated: GoAwayError is deprecated.
 type GoAwayError struct {
 	LastStreamID uint32
 	ErrCode      ErrCode
diff --git a/vendor/golang.org/x/net/http2/transport_wrap.go b/vendor/golang.org/x/net/http2/transport_wrap.go
index 741fb970..34dfb3cc 100644
--- a/vendor/golang.org/x/net/http2/transport_wrap.go
+++ b/vendor/golang.org/x/net/http2/transport_wrap.go
@@ -216,6 +216,8 @@ func (t *Transport) newUserClientConn(c net.Conn) (*ClientConn, error) {
 
 // ClientConn is the state of a single HTTP/2 client connection to an
 // HTTP/2 server.
+//
+// Deprecated: Use [http.ClientConn] instead.
 type ClientConn struct {
 	cc         *http.ClientConn
 	tconn      net.Conn
diff --git a/vendor/golang.org/x/net/internal/httpcommon/README.md b/vendor/golang.org/x/net/internal/httpcommon/README.md
new file mode 100644
index 00000000..951c346c
--- /dev/null
+++ b/vendor/golang.org/x/net/internal/httpcommon/README.md
@@ -0,0 +1,7 @@
+These two packages are identical:
+
+- net/http/internal/httpcommon
+- golang.org/x/net/internal/httpcommon
+
+The two are kept in sync manually.
+Any change to one should be made in the other.
diff --git a/vendor/golang.org/x/net/internal/httpcommon/request.go b/vendor/golang.org/x/net/internal/httpcommon/request.go
index d94c8742..5aaca598 100644
--- a/vendor/golang.org/x/net/internal/httpcommon/request.go
+++ b/vendor/golang.org/x/net/internal/httpcommon/request.go
@@ -391,6 +391,7 @@ type ServerRequestParam struct {
 // ServerRequestResult is the result of NewServerRequest.
 type ServerRequestResult struct {
 	// Various http.Request fields.
+	Host       string
 	URL        *url.URL
 	RequestURI string
 	Trailer    map[string][]string
@@ -433,20 +434,46 @@ func NewServerRequest(rp ServerRequestParam) ServerRequestResult {
 	}
 	delete(rp.Header, "Trailer")
 
+	authority := rp.Authority
+	if host := rp.Header["Host"]; len(host) == 1 {
+		// HTTP/2 and HTTP/3 permit the Host header to be present,
+		// but it must match the :authority pseudo-header.
+		if authority == "" {
+			authority = host[0]
+		} else if host[0] != authority {
+			return ServerRequestResult{
+				InvalidReason: "authority_host_mismatch",
+			}
+		}
+		delete(rp.Header, "Host")
+	} else if len(host) > 1 {
+		// HTTP/1.1 rejects any request containing more than one Host header.
+		// HTTP/2 and HTTP/3 don't use the Host header, but reject multiple anyway.
+		return ServerRequestResult{
+			InvalidReason: "multiple_host_headers",
+		}
+	}
+
 	// "':authority' MUST NOT include the deprecated userinfo subcomponent
 	// for "http" or "https" schemed URIs."
 	// https://www.rfc-editor.org/rfc/rfc9113.html#section-8.3.1-2.3.8
-	if strings.IndexByte(rp.Authority, '@') != -1 && (rp.Scheme == "http" || rp.Scheme == "https") {
+	if strings.IndexByte(authority, '@') != -1 && (rp.Scheme == "http" || rp.Scheme == "https") {
 		return ServerRequestResult{
 			InvalidReason: "userinfo_in_authority",
 		}
 	}
 
+	if authority != "" && !httpguts.ValidHostHeader(authority) {
+		return ServerRequestResult{
+			InvalidReason: "invalid_authority",
+		}
+	}
+
 	var url_ *url.URL
 	var requestURI string
 	if rp.Method == "CONNECT" && rp.Protocol == "" {
-		url_ = &url.URL{Host: rp.Authority}
-		requestURI = rp.Authority // mimic HTTP/1 server behavior
+		url_ = &url.URL{Host: authority}
+		requestURI = authority // mimic HTTP/1 server behavior
 	} else {
 		// "[The :path] pseudo-header field MUST NOT be empty [...]"
 		// https://www.rfc-editor.org/rfc/rfc9113.html#section-8.3.1-2.4.2
@@ -467,6 +494,7 @@ func NewServerRequest(rp ServerRequestParam) ServerRequestResult {
 	}
 
 	return ServerRequestResult{
+		Host:          authority,
 		URL:           url_,
 		NeedsContinue: needsContinue,
 		RequestURI:    requestURI,
diff --git a/vendor/golang.org/x/net/trace/histogram.go b/vendor/golang.org/x/net/trace/histogram.go
index d6c71101..2f786831 100644
--- a/vendor/golang.org/x/net/trace/histogram.go
+++ b/vendor/golang.org/x/net/trace/histogram.go
@@ -70,10 +70,7 @@ func log2(i int64) int {
 }
 
 func getBucket(i int64) (index int) {
-	index = log2(i) - 1
-	if index < 0 {
-		index = 0
-	}
+	index = max(log2(i)-1, 0)
 	if index >= bucketCount {
 		index = bucketCount - 1
 	}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 8435a3f6..4e4ff197 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -184,15 +184,15 @@ go.uber.org/mock/gomock
 # go.yaml.in/yaml/v3 v3.0.5
 ## explicit; go 1.16
 go.yaml.in/yaml/v3
-# golang.org/x/crypto v0.56.0
+# golang.org/x/crypto v0.57.0
 ## explicit; go 1.26.0
 golang.org/x/crypto/bcrypt
 golang.org/x/crypto/blowfish
-# golang.org/x/exp v0.0.0-20260824195058-e88cd73687aa
+# golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba
 ## explicit; go 1.26.0
 golang.org/x/exp/slices
-# golang.org/x/net v0.58.0
-## explicit; go 1.25.0
+# golang.org/x/net v0.59.0
+## explicit; go 1.26.0
 golang.org/x/net/http/httpguts
 golang.org/x/net/http2
 golang.org/x/net/http2/hpack