diff --git a/src/code.cloudfoundry.org/go.mod b/src/code.cloudfoundry.org/go.mod
index f7ef3ff826..4fc3842585 100644
--- a/src/code.cloudfoundry.org/go.mod
+++ b/src/code.cloudfoundry.org/go.mod
@@ -36,7 +36,7 @@ require (
 	code.cloudfoundry.org/eventhub v0.0.0-20231101144817-e1b5e1cd15a3
 	code.cloudfoundry.org/garden v0.0.0-20231107181549-21c262319eb4
 	code.cloudfoundry.org/go-loggregator/v8 v8.0.5
-	code.cloudfoundry.org/goshims v0.26.0
+	code.cloudfoundry.org/goshims v0.27.0
 	code.cloudfoundry.org/guardian v0.0.0-20231107182602-cbdd7088b881
 	code.cloudfoundry.org/lager/v3 v3.0.2
 	code.cloudfoundry.org/localip v0.0.0-20231101144618-f2950077affe
@@ -84,8 +84,8 @@ require (
 	github.com/tedsuo/ifrit v0.0.0-20230516164442-7862c310ad26
 	github.com/tedsuo/rata v1.0.0
 	github.com/vito/go-sse v1.0.0
-	golang.org/x/crypto v0.14.0
-	golang.org/x/net v0.17.0
+	golang.org/x/crypto v0.15.0
+	golang.org/x/net v0.18.0
 	golang.org/x/oauth2 v0.13.0
 	golang.org/x/sys v0.14.0
 	golang.org/x/time v0.4.0
diff --git a/src/code.cloudfoundry.org/go.sum b/src/code.cloudfoundry.org/go.sum
index 0011f48350..1420d5ccad 100644
--- a/src/code.cloudfoundry.org/go.sum
+++ b/src/code.cloudfoundry.org/go.sum
@@ -627,8 +627,8 @@ code.cloudfoundry.org/go-diodes v0.0.0-20231102232033-2a479dfa9870 h1:FCI4SHE7Kk
 code.cloudfoundry.org/go-diodes v0.0.0-20231102232033-2a479dfa9870/go.mod h1:9My+CcYUScWxCd/KEd8H4XqfKjPgt9gxhS5eCxYzKfY=
 code.cloudfoundry.org/go-loggregator/v8 v8.0.5 h1:p1rrGxTwUqLjlUVtbjTAvKOSGNmPuBja8LeQOQgRrBc=
 code.cloudfoundry.org/go-loggregator/v8 v8.0.5/go.mod h1:mLlJ1ZyG6gVvBEtYypvbztRvFeCtBsTxE9tt+85tS6Y=
-code.cloudfoundry.org/goshims v0.26.0 h1:iCRPKgxzaqxoMQib0rMjeUNUR33ryWL8QUCYIZM1H9s=
-code.cloudfoundry.org/goshims v0.26.0/go.mod h1:MhyDh5Kykq4pf91LCRxRyl+dv34ELCq3ndHzEE/S3i8=
+code.cloudfoundry.org/goshims v0.27.0 h1:pVP47NcoHs6DaDzitI30v+HOQIbyUXXtLZGl0w4yGOQ=
+code.cloudfoundry.org/goshims v0.27.0/go.mod h1:fF968J2MVsMRgkaVGcu508m3n3m0YnSkYz2iJg9Sd9M=
 code.cloudfoundry.org/lager/v3 v3.0.2 h1:H0dcQY+814G1Ea0e5K/AMaMpcr+Pe5Iv+AALJEwrP9U=
 code.cloudfoundry.org/lager/v3 v3.0.2/go.mod h1:zA6tOIWhr5uZUez+PGpdfBHDWQOfhOrr0cgKDagZPwk=
 code.cloudfoundry.org/localip v0.0.0-20231101144618-f2950077affe h1:YxAYJCNCe+04fkNNbmeKIBedLMJ63HlU0fgieCSNAck=
@@ -1211,8 +1211,8 @@ golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
-golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc=
-golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
+golang.org/x/crypto v0.15.0 h1:frVn1TEaCEaZcn3Tmd7Y2b5KKPaZ+I32Q2OA3kYp5TA=
+golang.org/x/crypto v0.15.0/go.mod h1:4ChreQoLWfG3xLDer1WdlH5NdlQ3+mwnQq1YTKY+72g=
 golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -1335,8 +1335,8 @@ golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
 golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
-golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
+golang.org/x/net v0.18.0 h1:mIYleuAkSbHh0tCv7RvjL3F6ZVbLjq4+R7zbOn3Kokg=
+golang.org/x/net v0.18.0/go.mod h1:/czyP5RqHAH4odGYxBJ1qz0+CE5WZ+2j1YgoEo8F2jQ=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1485,8 +1485,8 @@ golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
 golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek=
-golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
+golang.org/x/term v0.14.0 h1:LGK9IlZ8T9jvdy6cTdfKUCltatMFOehAQo9SRC46UQ8=
+golang.org/x/term v0.14.0/go.mod h1:TySc+nGkYR6qt8km8wUhuFRTVSMIX3XPR58y2lC8vww=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/blake2b/blake2bAVX2_amd64.go b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/blake2b/blake2bAVX2_amd64.go
index 56bfaaa17d..4f506f8791 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/blake2b/blake2bAVX2_amd64.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/blake2b/blake2bAVX2_amd64.go
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build go1.7 && amd64 && gc && !purego
-// +build go1.7,amd64,gc,!purego
 
 package blake2b
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/blake2b/blake2bAVX2_amd64.s b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/blake2b/blake2bAVX2_amd64.s
index 4b9daa18d9..353bb7cac5 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/blake2b/blake2bAVX2_amd64.s
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/blake2b/blake2bAVX2_amd64.s
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build go1.7 && amd64 && gc && !purego
-// +build go1.7,amd64,gc,!purego
 
 #include "textflag.h"
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/blake2b/blake2b_amd64.go b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/blake2b/blake2b_amd64.go
index 5fa1b32841..1d0770abba 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/blake2b/blake2b_amd64.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/blake2b/blake2b_amd64.go
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build !go1.7 && amd64 && gc && !purego
-// +build !go1.7,amd64,gc,!purego
 
 package blake2b
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/blake2b/blake2b_amd64.s b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/blake2b/blake2b_amd64.s
index ae75eb9afc..adfac00c15 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/blake2b/blake2b_amd64.s
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/blake2b/blake2b_amd64.s
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build amd64 && gc && !purego
-// +build amd64,gc,!purego
 
 #include "textflag.h"
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/blake2b/blake2b_ref.go b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/blake2b/blake2b_ref.go
index b0137cdf02..6e28668cd1 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/blake2b/blake2b_ref.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/blake2b/blake2b_ref.go
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build !amd64 || purego || !gc
-// +build !amd64 purego !gc
 
 package blake2b
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/blake2b/register.go b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/blake2b/register.go
index 9d8633963c..d9fcac3a4d 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/blake2b/register.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/blake2b/register.go
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build go1.9
-// +build go1.9
 
 package blake2b
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20/chacha_arm64.go b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20/chacha_arm64.go
index 5dfacbb983..661ea132e0 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20/chacha_arm64.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20/chacha_arm64.go
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build gc && !purego
-// +build gc,!purego
 
 package chacha20
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20/chacha_arm64.s b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20/chacha_arm64.s
index f1f66230d1..7dd2638e88 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20/chacha_arm64.s
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20/chacha_arm64.s
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build gc && !purego
-// +build gc,!purego
 
 #include "textflag.h"
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20/chacha_noasm.go b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20/chacha_noasm.go
index 02ff3d05e9..db42e6676a 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20/chacha_noasm.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20/chacha_noasm.go
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build (!arm64 && !s390x && !ppc64le) || !gc || purego
-// +build !arm64,!s390x,!ppc64le !gc purego
 
 package chacha20
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20/chacha_ppc64le.go b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20/chacha_ppc64le.go
index da420b2e97..3a4287f990 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20/chacha_ppc64le.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20/chacha_ppc64le.go
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build gc && !purego
-// +build gc,!purego
 
 package chacha20
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20/chacha_ppc64le.s b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20/chacha_ppc64le.s
index 5c0fed26f8..66aebae258 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20/chacha_ppc64le.s
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20/chacha_ppc64le.s
@@ -20,7 +20,6 @@
 // due to the calling conventions and initialization of constants.
 
 //go:build gc && !purego
-// +build gc,!purego
 
 #include "textflag.h"
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20/chacha_s390x.go b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20/chacha_s390x.go
index 4652247b8a..683ccfd1c3 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20/chacha_s390x.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20/chacha_s390x.go
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build gc && !purego
-// +build gc,!purego
 
 package chacha20
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20/chacha_s390x.s b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20/chacha_s390x.s
index f3ef5a019d..1eda91a3d4 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20/chacha_s390x.s
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20/chacha_s390x.s
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build gc && !purego
-// +build gc,!purego
 
 #include "go_asm.h"
 #include "textflag.h"
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.go b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.go
index 0c408c5709..50695a14f6 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.go
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build gc && !purego
-// +build gc,!purego
 
 package chacha20poly1305
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.s b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.s
index 867c181a14..731d2ac6db 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.s
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.s
@@ -5,7 +5,6 @@
 // This file was originally from https://golang.org/cl/24717 by Vlad Krasnov of CloudFlare.
 
 //go:build gc && !purego
-// +build gc,!purego
 
 #include "textflag.h"
 // General register allocation
@@ -184,11 +183,31 @@ GLOBL ·andMask<>(SB), (NOPTR+RODATA), $240
 #define shiftD1Right BYTE $0x66; BYTE $0x45; BYTE $0x0f; BYTE $0x3a; BYTE $0x0f; BYTE $0xd2; BYTE $0x04 // PALIGNR $4, X10, X10
 #define shiftD2Right BYTE $0x66; BYTE $0x45; BYTE $0x0f; BYTE $0x3a; BYTE $0x0f; BYTE $0xdb; BYTE $0x04 // PALIGNR $4, X11, X11
 #define shiftD3Right BYTE $0x66; BYTE $0x45; BYTE $0x0f; BYTE $0x3a; BYTE $0x0f; BYTE $0xff; BYTE $0x04 // PALIGNR $4, X15, X15
+
 // Some macros
+
+// ROL rotates the uint32s in register R left by N bits, using temporary T.
+#define ROL(N, R, T) \
+	MOVO R, T; PSLLL $(N), T; PSRLL $(32-(N)), R; PXOR T, R
+
+// ROL16 rotates the uint32s in register R left by 16, using temporary T if needed.
+#ifdef GOAMD64_v2
+#define ROL16(R, T) PSHUFB ·rol16<>(SB), R
+#else
+#define ROL16(R, T) ROL(16, R, T)
+#endif
+
+// ROL8 rotates the uint32s in register R left by 8, using temporary T if needed.
+#ifdef GOAMD64_v2
+#define ROL8(R, T) PSHUFB ·rol8<>(SB), R
+#else
+#define ROL8(R, T) ROL(8, R, T)
+#endif
+
 #define chachaQR(A, B, C, D, T) \
-	PADDD B, A; PXOR A, D; PSHUFB ·rol16<>(SB), D                            \
+	PADDD B, A; PXOR A, D; ROL16(D, T) \
 	PADDD D, C; PXOR C, B; MOVO B, T; PSLLL $12, T; PSRLL $20, B; PXOR T, B \
-	PADDD B, A; PXOR A, D; PSHUFB ·rol8<>(SB), D                             \
+	PADDD B, A; PXOR A, D; ROL8(D, T) \
 	PADDD D, C; PXOR C, B; MOVO B, T; PSLLL $7, T; PSRLL $25, B; PXOR T, B
 
 #define chachaQR_AVX2(A, B, C, D, T) \
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_noasm.go b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_noasm.go
index f832b33d45..34e6ab1df8 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_noasm.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_noasm.go
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build !amd64 || !gc || purego
-// +build !amd64 !gc purego
 
 package chacha20poly1305
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/curve25519/internal/field/fe_amd64.go b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/curve25519/internal/field/fe_amd64.go
index edcf163c4e..70c541692c 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/curve25519/internal/field/fe_amd64.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/curve25519/internal/field/fe_amd64.go
@@ -1,7 +1,6 @@
 // Code generated by command: go run fe_amd64_asm.go -out ../fe_amd64.s -stubs ../fe_amd64.go -pkg field. DO NOT EDIT.
 
 //go:build amd64 && gc && !purego
-// +build amd64,gc,!purego
 
 package field
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/curve25519/internal/field/fe_amd64.s b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/curve25519/internal/field/fe_amd64.s
index 293f013c94..60817acc41 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/curve25519/internal/field/fe_amd64.s
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/curve25519/internal/field/fe_amd64.s
@@ -1,7 +1,6 @@
 // Code generated by command: go run fe_amd64_asm.go -out ../fe_amd64.s -stubs ../fe_amd64.go -pkg field. DO NOT EDIT.
 
 //go:build amd64 && gc && !purego
-// +build amd64,gc,!purego
 
 #include "textflag.h"
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/curve25519/internal/field/fe_amd64_noasm.go b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/curve25519/internal/field/fe_amd64_noasm.go
index ddb6c9b8f7..9da280d1d8 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/curve25519/internal/field/fe_amd64_noasm.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/curve25519/internal/field/fe_amd64_noasm.go
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build !amd64 || !gc || purego
-// +build !amd64 !gc purego
 
 package field
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/curve25519/internal/field/fe_arm64.go b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/curve25519/internal/field/fe_arm64.go
index af459ef515..075fe9b925 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/curve25519/internal/field/fe_arm64.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/curve25519/internal/field/fe_arm64.go
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build arm64 && gc && !purego
-// +build arm64,gc,!purego
 
 package field
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/curve25519/internal/field/fe_arm64.s b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/curve25519/internal/field/fe_arm64.s
index 5c91e45892..3126a43419 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/curve25519/internal/field/fe_arm64.s
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/curve25519/internal/field/fe_arm64.s
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build arm64 && gc && !purego
-// +build arm64,gc,!purego
 
 #include "textflag.h"
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/curve25519/internal/field/fe_arm64_noasm.go b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/curve25519/internal/field/fe_arm64_noasm.go
index 234a5b2e5d..fc029ac12d 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/curve25519/internal/field/fe_arm64_noasm.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/curve25519/internal/field/fe_arm64_noasm.go
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build !arm64 || !gc || purego
-// +build !arm64 !gc purego
 
 package field
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/alias/alias.go b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/alias/alias.go
index 69c17f822b..551ff0c353 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/alias/alias.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/alias/alias.go
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build !purego
-// +build !purego
 
 // Package alias implements memory aliasing tests.
 package alias
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/alias/alias_purego.go b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/alias/alias_purego.go
index 4775b0a438..6fe61b5c6e 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/alias/alias_purego.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/alias/alias_purego.go
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build purego
-// +build purego
 
 // Package alias implements memory aliasing tests.
 package alias
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/bits_compat.go b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/bits_compat.go
index 45b5c966b2..d33c8890fc 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/bits_compat.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/bits_compat.go
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build !go1.13
-// +build !go1.13
 
 package poly1305
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/bits_go1.13.go b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/bits_go1.13.go
index ed52b3418a..495c1fa697 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/bits_go1.13.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/bits_go1.13.go
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build go1.13
-// +build go1.13
 
 package poly1305
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/mac_noasm.go b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/mac_noasm.go
index f184b67d98..333da285b3 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/mac_noasm.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/mac_noasm.go
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build (!amd64 && !ppc64le && !s390x) || !gc || purego
-// +build !amd64,!ppc64le,!s390x !gc purego
 
 package poly1305
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/sum_amd64.go b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/sum_amd64.go
index 6d522333f2..164cd47d32 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/sum_amd64.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/sum_amd64.go
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build gc && !purego
-// +build gc,!purego
 
 package poly1305
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/sum_amd64.s b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/sum_amd64.s
index 1d74f0f881..e0d3c64756 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/sum_amd64.s
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/sum_amd64.s
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build gc && !purego
-// +build gc,!purego
 
 #include "textflag.h"
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/sum_ppc64le.go b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/sum_ppc64le.go
index 4a069941a6..4aec4874b5 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/sum_ppc64le.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/sum_ppc64le.go
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build gc && !purego
-// +build gc,!purego
 
 package poly1305
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/sum_ppc64le.s b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/sum_ppc64le.s
index 58422aad23..d2ca5deeb9 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/sum_ppc64le.s
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/sum_ppc64le.s
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build gc && !purego
-// +build gc,!purego
 
 #include "textflag.h"
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/sum_s390x.go b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/sum_s390x.go
index ec95966889..e1d033a491 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/sum_s390x.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/sum_s390x.go
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build gc && !purego
-// +build gc,!purego
 
 package poly1305
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/sum_s390x.s b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/sum_s390x.s
index aa9e0494c9..0fe3a7c217 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/sum_s390x.s
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/internal/poly1305/sum_s390x.s
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build gc && !purego
-// +build gc,!purego
 
 #include "textflag.h"
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/salsa20/salsa/salsa20_amd64.go b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/salsa20/salsa/salsa20_amd64.go
index c400dfcf7b..e76b44fe59 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/salsa20/salsa/salsa20_amd64.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/salsa20/salsa/salsa20_amd64.go
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build amd64 && !purego && gc
-// +build amd64,!purego,gc
 
 package salsa
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/salsa20/salsa/salsa20_amd64.s b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/salsa20/salsa/salsa20_amd64.s
index c089277204..fcce0234b6 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/salsa20/salsa/salsa20_amd64.s
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/salsa20/salsa/salsa20_amd64.s
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build amd64 && !purego && gc
-// +build amd64,!purego,gc
 
 // This code was translated into a form compatible with 6a from the public
 // domain sources in SUPERCOP: https://bench.cr.yp.to/supercop.html
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/salsa20/salsa/salsa20_noasm.go b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/salsa20/salsa/salsa20_noasm.go
index 4392cc1ac7..9448760f26 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/salsa20/salsa/salsa20_noasm.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/salsa20/salsa/salsa20_noasm.go
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build !amd64 || purego || !gc
-// +build !amd64 purego !gc
 
 package salsa
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/ssh/common.go b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/ssh/common.go
index b419c761ed..dd2ab0d69a 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/ssh/common.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/ssh/common.go
@@ -10,7 +10,6 @@ import (
 	"fmt"
 	"io"
 	"math"
-	"strings"
 	"sync"
 
 	_ "crypto/sha1"
@@ -140,8 +139,6 @@ var supportedPubKeyAuthAlgos = []string{
 	KeyAlgoDSA,
 }
 
-var supportedPubKeyAuthAlgosList = strings.Join(supportedPubKeyAuthAlgos, ",")
-
 // unexpectedMessageError results when the SSH message that we received didn't
 // match what we wanted.
 func unexpectedMessageError(expected, got uint8) error {
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/ssh/handshake.go b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/ssh/handshake.go
index 70a7369ff9..49bbba7692 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/ssh/handshake.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/ssh/handshake.go
@@ -11,6 +11,7 @@ import (
 	"io"
 	"log"
 	"net"
+	"strings"
 	"sync"
 )
 
@@ -50,6 +51,10 @@ type handshakeTransport struct {
 	// connection.
 	hostKeys []Signer
 
+	// publicKeyAuthAlgorithms is non-empty if we are the server. In that case,
+	// it contains the supported client public key authentication algorithms.
+	publicKeyAuthAlgorithms []string
+
 	// hostKeyAlgorithms is non-empty if we are the client. In that case,
 	// we accept these key types from the server as host key.
 	hostKeyAlgorithms []string
@@ -141,6 +146,7 @@ func newClientTransport(conn keyingTransport, clientVersion, serverVersion []byt
 func newServerTransport(conn keyingTransport, clientVersion, serverVersion []byte, config *ServerConfig) *handshakeTransport {
 	t := newHandshakeTransport(conn, &config.Config, clientVersion, serverVersion)
 	t.hostKeys = config.hostKeys
+	t.publicKeyAuthAlgorithms = config.PublicKeyAuthAlgorithms
 	go t.readLoop()
 	go t.kexLoop()
 	return t
@@ -649,6 +655,7 @@ func (t *handshakeTransport) enterKeyExchange(otherInitPacket []byte) error {
 	// message with the server-sig-algs extension if the client supports it. See
 	// RFC 8308, Sections 2.4 and 3.1, and [PROTOCOL], Section 1.9.
 	if !isClient && firstKeyExchange && contains(clientInit.KexAlgos, "ext-info-c") {
+		supportedPubKeyAuthAlgosList := strings.Join(t.publicKeyAuthAlgorithms, ",")
 		extInfo := &extInfoMsg{
 			NumExtensions: 2,
 			Payload:       make([]byte, 0, 4+15+4+len(supportedPubKeyAuthAlgosList)+4+16+4+1),
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/ssh/keys.go b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/ssh/keys.go
index ef1bad731b..df4ebdada5 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/ssh/keys.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/ssh/keys.go
@@ -1232,16 +1232,27 @@ func ParseRawPrivateKeyWithPassphrase(pemBytes, passphrase []byte) (interface{},
 		return nil, fmt.Errorf("ssh: cannot decode encrypted private keys: %v", err)
 	}
 
+	var result interface{}
+
 	switch block.Type {
 	case "RSA PRIVATE KEY":
-		return x509.ParsePKCS1PrivateKey(buf)
+		result, err = x509.ParsePKCS1PrivateKey(buf)
 	case "EC PRIVATE KEY":
-		return x509.ParseECPrivateKey(buf)
+		result, err = x509.ParseECPrivateKey(buf)
 	case "DSA PRIVATE KEY":
-		return ParseDSAPrivateKey(buf)
+		result, err = ParseDSAPrivateKey(buf)
 	default:
-		return nil, fmt.Errorf("ssh: unsupported key type %q", block.Type)
+		err = fmt.Errorf("ssh: unsupported key type %q", block.Type)
 	}
+	// Because of deficiencies in the format, DecryptPEMBlock does not always
+	// detect an incorrect password. In these cases decrypted DER bytes is
+	// random noise. If the parsing of the key returns an asn1.StructuralError
+	// we return x509.IncorrectPasswordError.
+	if _, ok := err.(asn1.StructuralError); ok {
+		return nil, x509.IncorrectPasswordError
+	}
+
+	return result, err
 }
 
 // ParseDSAPrivateKey returns a DSA private key from its ASN.1 DER encoding, as
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/ssh/server.go b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/ssh/server.go
index 727c71b9c7..8f1505af94 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/ssh/server.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/crypto/ssh/server.go
@@ -64,6 +64,13 @@ type ServerConfig struct {
 	// Config contains configuration shared between client and server.
 	Config
 
+	// PublicKeyAuthAlgorithms specifies the supported client public key
+	// authentication algorithms. Note that this should not include certificate
+	// types since those use the underlying algorithm. This list is sent to the
+	// client if it supports the server-sig-algs extension. Order is irrelevant.
+	// If unspecified then a default set of algorithms is used.
+	PublicKeyAuthAlgorithms []string
+
 	hostKeys []Signer
 
 	// NoClientAuth is true if clients are allowed to connect without
@@ -201,6 +208,15 @@ func NewServerConn(c net.Conn, config *ServerConfig) (*ServerConn, <-chan NewCha
 	if fullConf.MaxAuthTries == 0 {
 		fullConf.MaxAuthTries = 6
 	}
+	if len(fullConf.PublicKeyAuthAlgorithms) == 0 {
+		fullConf.PublicKeyAuthAlgorithms = supportedPubKeyAuthAlgos
+	} else {
+		for _, algo := range fullConf.PublicKeyAuthAlgorithms {
+			if !contains(supportedPubKeyAuthAlgos, algo) {
+				return nil, nil, nil, fmt.Errorf("ssh: unsupported public key authentication algorithm %s", algo)
+			}
+		}
+	}
 	// Check if the config contains any unsupported key exchanges
 	for _, kex := range fullConf.KeyExchanges {
 		if _, ok := serverForbiddenKexAlgos[kex]; ok {
@@ -524,7 +540,7 @@ userAuthLoop:
 				return nil, parseError(msgUserAuthRequest)
 			}
 			algo := string(algoBytes)
-			if !contains(supportedPubKeyAuthAlgos, underlyingAlgo(algo)) {
+			if !contains(config.PublicKeyAuthAlgorithms, underlyingAlgo(algo)) {
 				authErr = fmt.Errorf("ssh: algorithm %q not accepted", algo)
 				break
 			}
@@ -591,7 +607,7 @@ userAuthLoop:
 				// algorithm name that corresponds to algo with
 				// sig.Format.  This is usually the same, but
 				// for certs, the names differ.
-				if !contains(supportedPubKeyAuthAlgos, sig.Format) {
+				if !contains(config.PublicKeyAuthAlgorithms, sig.Format) {
 					authErr = fmt.Errorf("ssh: algorithm %q not accepted", sig.Format)
 					break
 				}
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/net/context/go17.go b/src/code.cloudfoundry.org/vendor/golang.org/x/net/context/go17.go
index 2cb9c408f2..0c1b867937 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/net/context/go17.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/net/context/go17.go
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build go1.7
-// +build go1.7
 
 package context
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/net/context/go19.go b/src/code.cloudfoundry.org/vendor/golang.org/x/net/context/go19.go
index 64d31ecc3e..e31e35a904 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/net/context/go19.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/net/context/go19.go
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build go1.9
-// +build go1.9
 
 package context
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/net/context/pre_go17.go b/src/code.cloudfoundry.org/vendor/golang.org/x/net/context/pre_go17.go
index 7b6b685114..065ff3dfa5 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/net/context/pre_go17.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/net/context/pre_go17.go
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build !go1.7
-// +build !go1.7
 
 package context
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/net/context/pre_go19.go b/src/code.cloudfoundry.org/vendor/golang.org/x/net/context/pre_go19.go
index 1f9715341f..ec5a638033 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/net/context/pre_go19.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/net/context/pre_go19.go
@@ -3,7 +3,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build !go1.9
-// +build !go1.9
 
 package context
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/databuffer.go b/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/databuffer.go
index a3067f8de7..e6f55cbd16 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/databuffer.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/databuffer.go
@@ -20,41 +20,44 @@ import (
 // TODO: Benchmark to determine if the pools are necessary. The GC may have
 // improved enough that we can instead allocate chunks like this:
 // make([]byte, max(16<<10, expectedBytesRemaining))
-var (
-	dataChunkSizeClasses = []int{
-		1 << 10,
-		2 << 10,
-		4 << 10,
-		8 << 10,
-		16 << 10,
-	}
-	dataChunkPools = [...]sync.Pool{
-		{New: func() interface{} { return make([]byte, 1<<10) }},
-		{New: func() interface{} { return make([]byte, 2<<10) }},
-		{New: func() interface{} { return make([]byte, 4<<10) }},
-		{New: func() interface{} { return make([]byte, 8<<10) }},
-		{New: func() interface{} { return make([]byte, 16<<10) }},
-	}
-)
+var dataChunkPools = [...]sync.Pool{
+	{New: func() interface{} { return new([1 << 10]byte) }},
+	{New: func() interface{} { return new([2 << 10]byte) }},
+	{New: func() interface{} { return new([4 << 10]byte) }},
+	{New: func() interface{} { return new([8 << 10]byte) }},
+	{New: func() interface{} { return new([16 << 10]byte) }},
+}
 
 func getDataBufferChunk(size int64) []byte {
-	i := 0
-	for ; i < len(dataChunkSizeClasses)-1; i++ {
-		if size <= int64(dataChunkSizeClasses[i]) {
-			break
-		}
+	switch {
+	case size <= 1<<10:
+		return dataChunkPools[0].Get().(*[1 << 10]byte)[:]
+	case size <= 2<<10:
+		return dataChunkPools[1].Get().(*[2 << 10]byte)[:]
+	case size <= 4<<10:
+		return dataChunkPools[2].Get().(*[4 << 10]byte)[:]
+	case size <= 8<<10:
+		return dataChunkPools[3].Get().(*[8 << 10]byte)[:]
+	default:
+		return dataChunkPools[4].Get().(*[16 << 10]byte)[:]
 	}
-	return dataChunkPools[i].Get().([]byte)
 }
 
 func putDataBufferChunk(p []byte) {
-	for i, n := range dataChunkSizeClasses {
-		if len(p) == n {
-			dataChunkPools[i].Put(p)
-			return
-		}
+	switch len(p) {
+	case 1 << 10:
+		dataChunkPools[0].Put((*[1 << 10]byte)(p))
+	case 2 << 10:
+		dataChunkPools[1].Put((*[2 << 10]byte)(p))
+	case 4 << 10:
+		dataChunkPools[2].Put((*[4 << 10]byte)(p))
+	case 8 << 10:
+		dataChunkPools[3].Put((*[8 << 10]byte)(p))
+	case 16 << 10:
+		dataChunkPools[4].Put((*[16 << 10]byte)(p))
+	default:
+		panic(fmt.Sprintf("unexpected buffer len=%v", len(p)))
 	}
-	panic(fmt.Sprintf("unexpected buffer len=%v", len(p)))
 }
 
 // dataBuffer is an io.ReadWriter backed by a list of data chunks.
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/go111.go b/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/go111.go
deleted file mode 100644
index 5bf62b032e..0000000000
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/go111.go
+++ /dev/null
@@ -1,30 +0,0 @@
-// Copyright 2018 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build go1.11
-// +build go1.11
-
-package http2
-
-import (
-	"net/http/httptrace"
-	"net/textproto"
-)
-
-func traceHasWroteHeaderField(trace *httptrace.ClientTrace) bool {
-	return trace != nil && trace.WroteHeaderField != nil
-}
-
-func traceWroteHeaderField(trace *httptrace.ClientTrace, k, v string) {
-	if trace != nil && trace.WroteHeaderField != nil {
-		trace.WroteHeaderField(k, []string{v})
-	}
-}
-
-func traceGot1xxResponseFunc(trace *httptrace.ClientTrace) func(int, textproto.MIMEHeader) error {
-	if trace != nil {
-		return trace.Got1xxResponse
-	}
-	return nil
-}
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/go115.go b/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/go115.go
deleted file mode 100644
index 908af1ab93..0000000000
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/go115.go
+++ /dev/null
@@ -1,27 +0,0 @@
-// Copyright 2021 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build go1.15
-// +build go1.15
-
-package http2
-
-import (
-	"context"
-	"crypto/tls"
-)
-
-// dialTLSWithContext uses tls.Dialer, added in Go 1.15, to open a TLS
-// connection.
-func (t *Transport) dialTLSWithContext(ctx context.Context, network, addr string, cfg *tls.Config) (*tls.Conn, error) {
-	dialer := &tls.Dialer{
-		Config: cfg,
-	}
-	cn, err := dialer.DialContext(ctx, network, addr)
-	if err != nil {
-		return nil, err
-	}
-	tlsCn := cn.(*tls.Conn) // DialContext comment promises this will always succeed
-	return tlsCn, nil
-}
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/go118.go b/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/go118.go
deleted file mode 100644
index aca4b2b31a..0000000000
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/go118.go
+++ /dev/null
@@ -1,17 +0,0 @@
-// Copyright 2021 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build go1.18
-// +build go1.18
-
-package http2
-
-import (
-	"crypto/tls"
-	"net"
-)
-
-func tlsUnderlyingConn(tc *tls.Conn) net.Conn {
-	return tc.NetConn()
-}
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/not_go111.go b/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/not_go111.go
deleted file mode 100644
index cc0baa8197..0000000000
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/not_go111.go
+++ /dev/null
@@ -1,21 +0,0 @@
-// Copyright 2018 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build !go1.11
-// +build !go1.11
-
-package http2
-
-import (
-	"net/http/httptrace"
-	"net/textproto"
-)
-
-func traceHasWroteHeaderField(trace *httptrace.ClientTrace) bool { return false }
-
-func traceWroteHeaderField(trace *httptrace.ClientTrace, k, v string) {}
-
-func traceGot1xxResponseFunc(trace *httptrace.ClientTrace) func(int, textproto.MIMEHeader) error {
-	return nil
-}
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/not_go115.go b/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/not_go115.go
deleted file mode 100644
index e6c04cf7ac..0000000000
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/not_go115.go
+++ /dev/null
@@ -1,31 +0,0 @@
-// Copyright 2021 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build !go1.15
-// +build !go1.15
-
-package http2
-
-import (
-	"context"
-	"crypto/tls"
-)
-
-// dialTLSWithContext opens a TLS connection.
-func (t *Transport) dialTLSWithContext(ctx context.Context, network, addr string, cfg *tls.Config) (*tls.Conn, error) {
-	cn, err := tls.Dial(network, addr, cfg)
-	if err != nil {
-		return nil, err
-	}
-	if err := cn.Handshake(); err != nil {
-		return nil, err
-	}
-	if cfg.InsecureSkipVerify {
-		return cn, nil
-	}
-	if err := cn.VerifyHostname(cfg.ServerName); err != nil {
-		return nil, err
-	}
-	return cn, nil
-}
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/not_go118.go b/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/not_go118.go
deleted file mode 100644
index eab532c96b..0000000000
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/not_go118.go
+++ /dev/null
@@ -1,17 +0,0 @@
-// Copyright 2021 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build !go1.18
-// +build !go1.18
-
-package http2
-
-import (
-	"crypto/tls"
-	"net"
-)
-
-func tlsUnderlyingConn(tc *tls.Conn) net.Conn {
-	return nil
-}
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/server.go b/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/server.go
index 02c88b6b3e..ae94c6408d 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/server.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/server.go
@@ -2549,7 +2549,6 @@ type responseWriterState struct {
 	wroteHeader   bool        // WriteHeader called (explicitly or implicitly). Not necessarily sent to user yet.
 	sentHeader    bool        // have we sent the header frame?
 	handlerDone   bool        // handler has finished
-	dirty         bool        // a Write failed; don't reuse this responseWriterState
 
 	sentContentLen int64 // non-zero if handler set a Content-Length header
 	wroteBytes     int64
@@ -2669,7 +2668,6 @@ func (rws *responseWriterState) writeChunk(p []byte) (n int, err error) {
 			date:          date,
 		})
 		if err != nil {
-			rws.dirty = true
 			return 0, err
 		}
 		if endStream {
@@ -2690,7 +2688,6 @@ func (rws *responseWriterState) writeChunk(p []byte) (n int, err error) {
 	if len(p) > 0 || endStream {
 		// only send a 0 byte DATA frame if we're ending the stream.
 		if err := rws.conn.writeDataFromHandler(rws.stream, p, endStream); err != nil {
-			rws.dirty = true
 			return 0, err
 		}
 	}
@@ -2702,9 +2699,6 @@ func (rws *responseWriterState) writeChunk(p []byte) (n int, err error) {
 			trailers:  rws.trailers,
 			endStream: true,
 		})
-		if err != nil {
-			rws.dirty = true
-		}
 		return len(p), err
 	}
 	return len(p), nil
@@ -2920,14 +2914,12 @@ func (rws *responseWriterState) writeHeader(code int) {
 			h.Del("Transfer-Encoding")
 		}
 
-		if rws.conn.writeHeaders(rws.stream, &writeResHeaders{
+		rws.conn.writeHeaders(rws.stream, &writeResHeaders{
 			streamID:    rws.stream.id,
 			httpResCode: code,
 			h:           h,
 			endStream:   rws.handlerDone && !rws.hasTrailers(),
-		}) != nil {
-			rws.dirty = true
-		}
+		})
 
 		return
 	}
@@ -2992,19 +2984,10 @@ func (w *responseWriter) write(lenData int, dataB []byte, dataS string) (n int,
 
 func (w *responseWriter) handlerDone() {
 	rws := w.rws
-	dirty := rws.dirty
 	rws.handlerDone = true
 	w.Flush()
 	w.rws = nil
-	if !dirty {
-		// Only recycle the pool if all prior Write calls to
-		// the serverConn goroutine completed successfully. If
-		// they returned earlier due to resets from the peer
-		// there might still be write goroutines outstanding
-		// from the serverConn referencing the rws memory. See
-		// issue 20704.
-		responseWriterStatePool.Put(rws)
-	}
+	responseWriterStatePool.Put(rws)
 }
 
 // Push errors.
@@ -3187,6 +3170,7 @@ func (sc *serverConn) startPush(msg *startPushRequest) {
 			panic(fmt.Sprintf("newWriterAndRequestNoBody(%+v): %v", msg.url, err))
 		}
 
+		sc.curHandlers++
 		go sc.runHandler(rw, req, sc.handler.ServeHTTP)
 		return promisedID, nil
 	}
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/transport.go b/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/transport.go
index 4515b22c4a..df578b86c6 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/transport.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/net/http2/transport.go
@@ -1018,7 +1018,7 @@ func (cc *ClientConn) forceCloseConn() {
 	if !ok {
 		return
 	}
-	if nc := tlsUnderlyingConn(tc); nc != nil {
+	if nc := tc.NetConn(); nc != nil {
 		nc.Close()
 	}
 }
@@ -3201,3 +3201,34 @@ func traceFirstResponseByte(trace *httptrace.ClientTrace) {
 		trace.GotFirstResponseByte()
 	}
 }
+
+func traceHasWroteHeaderField(trace *httptrace.ClientTrace) bool {
+	return trace != nil && trace.WroteHeaderField != nil
+}
+
+func traceWroteHeaderField(trace *httptrace.ClientTrace, k, v string) {
+	if trace != nil && trace.WroteHeaderField != nil {
+		trace.WroteHeaderField(k, []string{v})
+	}
+}
+
+func traceGot1xxResponseFunc(trace *httptrace.ClientTrace) func(int, textproto.MIMEHeader) error {
+	if trace != nil {
+		return trace.Got1xxResponse
+	}
+	return nil
+}
+
+// dialTLSWithContext uses tls.Dialer, added in Go 1.15, to open a TLS
+// connection.
+func (t *Transport) dialTLSWithContext(ctx context.Context, network, addr string, cfg *tls.Config) (*tls.Conn, error) {
+	dialer := &tls.Dialer{
+		Config: cfg,
+	}
+	cn, err := dialer.DialContext(ctx, network, addr)
+	if err != nil {
+		return nil, err
+	}
+	tlsCn := cn.(*tls.Conn) // DialContext comment promises this will always succeed
+	return tlsCn, nil
+}
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/go118.go b/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/go118.go
index c5c4338dbe..712f1ad839 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/go118.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/go118.go
@@ -5,7 +5,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build go1.18
-// +build go1.18
 
 package idna
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/idna10.0.0.go b/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/idna10.0.0.go
index 64ccf85feb..7b37178847 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/idna10.0.0.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/idna10.0.0.go
@@ -5,7 +5,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build go1.10
-// +build go1.10
 
 // Package idna implements IDNA2008 using the compatibility processing
 // defined by UTS (Unicode Technical Standard) #46, which defines a standard to
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/idna9.0.0.go b/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/idna9.0.0.go
index ee1698cefb..cc6a892a4a 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/idna9.0.0.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/idna9.0.0.go
@@ -5,7 +5,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build !go1.10
-// +build !go1.10
 
 // Package idna implements IDNA2008 using the compatibility processing
 // defined by UTS (Unicode Technical Standard) #46, which defines a standard to
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/pre_go118.go b/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/pre_go118.go
index 3aaccab1c5..40e74bb3d2 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/pre_go118.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/pre_go118.go
@@ -5,7 +5,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build !go1.18
-// +build !go1.18
 
 package idna
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/tables10.0.0.go b/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/tables10.0.0.go
index d1d62ef459..c6c2bf10a6 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/tables10.0.0.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/tables10.0.0.go
@@ -1,7 +1,6 @@
 // Code generated by running "go generate" in golang.org/x/text. DO NOT EDIT.
 
 //go:build go1.10 && !go1.13
-// +build go1.10,!go1.13
 
 package idna
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/tables11.0.0.go b/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/tables11.0.0.go
index 167efba712..76789393cc 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/tables11.0.0.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/tables11.0.0.go
@@ -1,7 +1,6 @@
 // Code generated by running "go generate" in golang.org/x/text. DO NOT EDIT.
 
 //go:build go1.13 && !go1.14
-// +build go1.13,!go1.14
 
 package idna
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/tables12.0.0.go b/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/tables12.0.0.go
index ab40f7bcc3..0600cd2ae5 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/tables12.0.0.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/tables12.0.0.go
@@ -1,7 +1,6 @@
 // Code generated by running "go generate" in golang.org/x/text. DO NOT EDIT.
 
 //go:build go1.14 && !go1.16
-// +build go1.14,!go1.16
 
 package idna
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/tables13.0.0.go b/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/tables13.0.0.go
index 66701eadfb..2fb768ef6d 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/tables13.0.0.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/tables13.0.0.go
@@ -1,7 +1,6 @@
 // Code generated by running "go generate" in golang.org/x/text. DO NOT EDIT.
 
 //go:build go1.16 && !go1.21
-// +build go1.16,!go1.21
 
 package idna
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/tables15.0.0.go b/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/tables15.0.0.go
index 40033778f0..5ff05fe1af 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/tables15.0.0.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/tables15.0.0.go
@@ -1,7 +1,6 @@
 // Code generated by running "go generate" in golang.org/x/text. DO NOT EDIT.
 
 //go:build go1.21
-// +build go1.21
 
 package idna
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/tables9.0.0.go b/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/tables9.0.0.go
index 4074b5332e..0f25e84ca2 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/tables9.0.0.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/tables9.0.0.go
@@ -1,7 +1,6 @@
 // Code generated by running "go generate" in golang.org/x/text. DO NOT EDIT.
 
 //go:build !go1.10
-// +build !go1.10
 
 package idna
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/trie12.0.0.go b/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/trie12.0.0.go
index bb63f904b3..8a75b96673 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/trie12.0.0.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/trie12.0.0.go
@@ -5,7 +5,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build !go1.16
-// +build !go1.16
 
 package idna
 
diff --git a/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/trie13.0.0.go b/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/trie13.0.0.go
index 7d68a8dc13..fa45bb9074 100644
--- a/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/trie13.0.0.go
+++ b/src/code.cloudfoundry.org/vendor/golang.org/x/net/idna/trie13.0.0.go
@@ -5,7 +5,6 @@
 // license that can be found in the LICENSE file.
 
 //go:build go1.16
-// +build go1.16
 
 package idna
 
diff --git a/src/code.cloudfoundry.org/vendor/modules.txt b/src/code.cloudfoundry.org/vendor/modules.txt
index 77fcd6021d..8a31a5c453 100644
--- a/src/code.cloudfoundry.org/vendor/modules.txt
+++ b/src/code.cloudfoundry.org/vendor/modules.txt
@@ -82,7 +82,7 @@ code.cloudfoundry.org/go-loggregator/v8
 code.cloudfoundry.org/go-loggregator/v8/rfc5424
 code.cloudfoundry.org/go-loggregator/v8/rpc/loggregator_v2
 code.cloudfoundry.org/go-loggregator/v8/runtimeemitter
-# code.cloudfoundry.org/goshims v0.26.0
+# code.cloudfoundry.org/goshims v0.27.0
 ## explicit; go 1.20
 code.cloudfoundry.org/goshims/filepathshim
 code.cloudfoundry.org/goshims/http_wrap
@@ -741,8 +741,8 @@ go.step.sm/crypto/x25519
 go.uber.org/automaxprocs/internal/cgroups
 go.uber.org/automaxprocs/internal/runtime
 go.uber.org/automaxprocs/maxprocs
-# golang.org/x/crypto v0.14.0
-## explicit; go 1.17
+# golang.org/x/crypto v0.15.0
+## explicit; go 1.18
 golang.org/x/crypto/bcrypt
 golang.org/x/crypto/blake2b
 golang.org/x/crypto/blowfish
@@ -766,8 +766,8 @@ golang.org/x/crypto/ssh/internal/bcrypt_pbkdf
 # golang.org/x/mod v0.14.0
 ## explicit; go 1.18
 golang.org/x/mod/semver
-# golang.org/x/net v0.17.0
-## explicit; go 1.17
+# golang.org/x/net v0.18.0
+## explicit; go 1.18
 golang.org/x/net/context
 golang.org/x/net/html
 golang.org/x/net/html/atom